6156851663

Committed 12 Sep 2023 08:26AM UTC coverage: 80.999% (+0.006%) from 80.993%

Build # 6156851663

Build Type

push

github

Committed by

web-flow

Commit Message

refactor(netxlite): use *Netx for creating HTTP3 transports (#1254)

This diff is like
https://github.com/ooni/probe-cli/commit/50279a7f6
but uses *Netx to create HTTP3 transports.

The general idea of this patchset is to ensure we're not using duplicate
code for constructing netxlite types, which is good to do now, because
we're about to introduce new netxlite types for the network with which
we communicate with the OONI backend.

Reference issue: https://github.com/ooni/probe/issues/2531

Run Details

8 of 8 new or added lines in 1 file covered. (100.0%)

7 existing lines in 2 files now uncovered.

22320 of 27556 relevant lines covered (81.0%)

28.56 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

82.43

/internal/experiment/webconnectivitylte/analysisdns.go

package webconnectivitylte

//
// DNS analysis
//

import (
        "net"
        "net/url"

        "github.com/ooni/probe-cli/v3/internal/model"
        "github.com/ooni/probe-cli/v3/internal/netxlite"
)

const (
        // AnalysisDNSBogon indicates we got any bogon reply
        AnalysisDNSBogon = 1 << iota

        // AnalysisDNSUnexpectedFailure indicates the TH could
        // resolve a domain while the probe couldn't
        AnalysisDNSUnexpectedFailure

        // AnalysisDNSUnexpectedAddrs indicates the TH resolved
        // different addresses from the probe
        AnalysisDNSUnexpectedAddrs
)

// analysisDNSToplevel is the toplevel analysis function for DNS results.
//
// Note: this function DOES NOT consider failed DNS-over-HTTPS (DoH) submeasurements
// and ONLY considers the IP addrs they have resolved. Failing to contact a DoH service
// provides info about such a DoH service rather than on the measured URL. See the
// https://github.com/ooni/probe/issues/2274 issue for more info.
//
// The goals of this function are the following:
//
// 1. Set the legacy .DNSExperimentFailure field to the failure value of the
// first DNS query that failed among the ones we actually tried. Because we
// have multiple queries, unfortunately we are forced to pick one error among
// possibly many to assign to this field. This is why I consider it legacy.
//
// 2. Compute the XDNSFlags value.
//
// From the XDNSFlags value, we determine, in turn DNSConsistency and
// XBlockingFlags according to the following decision table:
//
//        +-----------+----------------+---------------------+
//        | XDNSFlags | DNSConsistency | XBlockingFlags      |
//        +-----------+----------------+---------------------+
//        | 0         | "consistent"   | no change           |
//        +-----------+----------------+---------------------+
//        | nonzero   | "inconsistent" | set FlagDNSBlocking |
//        +-----------+----------------+---------------------+
//
// We explain how XDNSFlags is determined in the documentation of
// the functions that this function calls to do its job.
func (tk *TestKeys) analysisDNSToplevel(logger model.Logger, lookupper model.GeoIPASNLookupper) {
        tk.analysisDNSExperimentFailure()
        tk.analysisDNSBogon(logger)
        tk.analysisDNSDuplicateResponses(logger)
        tk.analysisDNSUnexpectedFailure(logger)
        tk.analysisDNSUnexpectedAddrs(logger, lookupper)
        if tk.DNSFlags != 0 {
                logger.Warn("DNSConsistency: inconsistent")
                tk.DNSConsistency = "inconsistent"
                tk.BlockingFlags |= analysisFlagDNSBlocking
        } else {
                logger.Info("DNSConsistency: consistent")
                tk.DNSConsistency = "consistent"
        }
}

// analysisDNSDuplicateResponses checks whether we received duplicate
// replies for DNS-over-UDP queries, which is very unexpected.
func (tk *TestKeys) analysisDNSDuplicateResponses(logger model.Logger) {
        if length := len(tk.DNSDuplicateResponses); length > 0 {
                // TODO(bassosimone): write algorithm to analyze this
                logger.Warnf("DNS: got %d unexpected late/duplicate DNS responses", length)
        }
}

// analysisDNSExperimentFailure sets the legacy DNSExperimentFailure field.
func (tk *TestKeys) analysisDNSExperimentFailure() {
        for _, query := range tk.Queries {
                if fail := query.Failure; fail != nil {
                        if query.QueryType == "AAAA" && *query.Failure == netxlite.FailureDNSNoAnswer {
                                // maybe this heuristic could be further improved by checking
                                // whether the TH did actually see any IPv6 address?
                                continue
                        }
                        if query.Engine == "doh" {
                                // we SHOULD NOT flag DoH failures _because_ they pertain to the
                                // DoH service rather than to the input URL
                                //
                                // See https://github.com/ooni/probe/issues/2274
                                continue
                        }
                        tk.DNSExperimentFailure = fail
                        return
                }
        }
}

// analysisDNSBogon computes the AnalysisDNSBogon flag. We set this flag if
// we dectect any bogon in the .Queries field of the TestKeys.
func (tk *TestKeys) analysisDNSBogon(logger model.Logger) {
        for _, query := range tk.Queries {
                // Implementation note: any bogon IP address resolved by a DoH service
                // is STILL suspicious since it should not happen. TODO(bassosimone): an
                // even better algorithm could possibly check whether also the TH has
                // observed bogon IP addrs and avoid flagging in such a case.
                //
                // See https://github.com/ooni/probe/issues/2274
                for _, answer := range query.Answers {
                        switch answer.AnswerType {
                        case "A":
                                if net.ParseIP(answer.IPv4) != nil && netxlite.IsBogon(answer.IPv4) {
                                        logger.Warnf(
                                                "DNS: got BOGON answer %s for domain %s (see #%d)",
                                                answer.IPv4,
                                                query.Hostname,
                                                query.TransactionID,
                                        )
                                        tk.DNSFlags |= AnalysisDNSBogon
                                        // continue processing so we print all the bogons we have
                                }
                        case "AAAA":
                                if net.ParseIP(answer.IPv6) != nil && netxlite.IsBogon(answer.IPv6) {
                                        logger.Warnf(
                                                "DNS: got BOGON answer %s for domain %s (see #%d)",
                                                answer.IPv6,
                                                query.Hostname,
                                                query.TransactionID,
                                        )
                                        tk.DNSFlags |= AnalysisDNSBogon
                                        // continue processing so we print all the bogons we have
                                }
                        default:
                                // nothing
                        }
                }
        }
}

// analysisDNSUnexpectedFailure computes the AnalysisDNSUnexpectedFailure flags. We say
// a failure is unexpected when the TH could resolve a domain and the probe couldn't.
func (tk *TestKeys) analysisDNSUnexpectedFailure(logger model.Logger) {
        // make sure we have control before proceeding futher
        if tk.Control == nil || tk.ControlRequest == nil {
                return
        }

        // obtain thRequest and thResponse as shortcuts
        thRequest := tk.ControlRequest
        thResponse := tk.Control

        // obtain the domain that the TH has queried for
        URL, err := url.Parse(thRequest.HTTPRequest)
        if err != nil {
                return // this looks like a bug
        }
        domain := URL.Hostname()

        // we obviously don't care if the domain was an IP adddress
        if net.ParseIP(domain) != nil {
                return
        }

        // if the control didn't lookup any IP addresses our job here is done
        // because we can't say whether we have unexpected failures
        hasAddrs := len(thResponse.DNS.Addrs) > 0
        if !hasAddrs {
                return
        }

        // with TH-resolved addrs, any local query _for the same domain_ queried
        // by the probe that contains an error is suspicious
        for _, query := range tk.Queries {
                if domain != query.Hostname {
                        continue // not the domain queried by the test helper
                }
                if query.Engine == "doh" {
                        // As mentioned above, a DoH failure is not information about
                        // the URL we're measuring but about the DoH service being blocked.
                        //
                        // See https://github.com/ooni/probe/issues/2274
                        continue
                }
                hasAddrs := false
        Loop:
                for _, answer := range query.Answers {
                        switch answer.AnswerType {
                        case "A", "AAA":
                                hasAddrs = true
                                break Loop
                        }
                }
                if hasAddrs {
                        // if the lookup returned any IP address, we are
                        // not dealing with unexpected failures
                        continue
                }
                if query.Failure == nil {
                        // we expect to see a failure if we don't see
                        // answers, so this seems a bug?
                        continue
                }
                if query.QueryType == "AAAA" && *query.Failure == netxlite.FailureDNSNoAnswer {
                        // maybe this heuristic could be further improved by checking
                        // whether the TH did actually see any IPv6 address?
                        continue
                }
                logger.Warnf("DNS: unexpected failure %s in #%d", *query.Failure, query.TransactionID)
                tk.DNSFlags |= AnalysisDNSUnexpectedFailure
                // continue processing so we print all the unexpected failures

                // TODO(https://github.com/ooni/probe/issues/2029#issuecomment-1411716295): we need
                // to ensure we correctly handle the android_dns_cache_no_data case.
        }
}

// analysisDNSUnexpectedAddrs computes the AnalysisDNSUnexpectedAddrs flags. This
// algorithm builds upon the original DNSDiff algorithm by introducing an additional
// TLS based heuristic for determining whether an IP address was legit.
func (tk *TestKeys) analysisDNSUnexpectedAddrs(
        logger model.Logger,
        lookupper model.GeoIPASNLookupper,
) {
        // make sure we have control before proceeding futher
        if tk.Control == nil || tk.ControlRequest == nil {
                return
        }

        // obtain thRequest and thResponse as shortcuts
        thRequest := tk.ControlRequest
        thResponse := tk.Control

        // obtain the domain that the TH has queried for
        URL, err := url.Parse(thRequest.HTTPRequest)
        if err != nil {
                return // this looks like a bug
        }
        domain := URL.Hostname()

        // we obviously don't care if the domain was an IP adddress
        if net.ParseIP(domain) != nil {
                return
        }

        // if the control didn't resolve any IP address, then we basically
        // cannot run this algorithm at all
        thAddrs := thResponse.DNS.Addrs
        if len(thAddrs) <= 0 {
                return
        }

        // gather all the IP addresses queried by the probe
        // for the same domain for which the TH queried.
        var probeAddrs []string
        for _, query := range tk.Queries {
                if domain != query.Hostname {
                        continue // not the domain the TH queried for
                }
                // Implementation note: in the case in which DoH returned answers, here
                // it still feels okay to consider them. We should avoid flagging DoH
                // failures as measurement failures but if DoH returns us some unexpected
                // even-non-bogon addr, it seems worth flagging for now.
                //
                // See https://github.com/ooni/probe/issues/2274
                for _, answer := range query.Answers {
                        switch answer.AnswerType {
                        case "A":
                                probeAddrs = append(probeAddrs, answer.IPv4)
                        case "AAAA":
                                probeAddrs = append(probeAddrs, answer.IPv6)
                        }
                }
        }

        // if the probe has not collected any addr for the same domain, it's
        // definitely suspicious and counts as a difference
        if len(probeAddrs) <= 0 {
                logger.Warnf("DNS: the probe did not resolve any IP address")
                tk.DNSFlags |= AnalysisDNSUnexpectedAddrs
                return
        }

        // if there are no different addresses between the probe and the TH then
        // our job here is done and we can just stop searching
        differentAddrs := tk.analysisDNSDiffAddrs(probeAddrs, thAddrs)
        if len(differentAddrs) <= 0 {
                return
        }
        for _, addr := range differentAddrs {
                logger.Infof("DNS: address %s: not resolved by TH", addr)
        }

        // now, let's exclude the differentAddrs for which we successfully
        // completed a TLS handshake: those should be good addrs
        withoutHandshake := tk.findAddrsWithoutTLSHandshake(domain, differentAddrs)
        if len(withoutHandshake) <= 0 {
                return
        }
        for _, addr := range withoutHandshake {
                logger.Infof("DNS: address %s: cannot confirm using TLS handshake", addr)
        }

        // as a last resort, accept the addresses without an handshake whose
        // ASN overlaps with ASNs resolved by the TH
        differentASNs := tk.analysisDNSDiffASN(logger, withoutHandshake, thAddrs, lookupper)
        if len(differentASNs) <= 0 {
                return
        }

        // otherwise, conclude we have unexpected probe addrs
        for addr, asn := range differentASNs {
                logger.Warnf(
                        "DNS: address %s has unexpected AS%d and we cannot use TLS to confirm it",
                        addr, asn,
                )
        }
        tk.DNSFlags |= AnalysisDNSUnexpectedAddrs
}

// analysisDNSDiffAddrs returns all the IP addresses that are
// resolved by the probe but not by the test helper.
func (tk *TestKeys) analysisDNSDiffAddrs(probeAddrs, thAddrs []string) (diff []string) {
        const (
                inProbe = 1 << iota
                inTH
        )
        mapping := make(map[string]int)
        for _, addr := range probeAddrs {
                if net.ParseIP(addr) != nil && netxlite.IsBogon(addr) {
                        // we can exclude bogons from the analysis because we already analyzed them
                        continue
                }
                mapping[addr] |= inProbe
        }
        for _, addr := range thAddrs {
                mapping[addr] = inTH
        }
        for addr, where := range mapping {
                if (where & inTH) == 0 {
                        diff = append(diff, addr)
                }
        }
        return
}

// analysisDNSDiffASN returns whether there are IP addresses in the probe's
// list with different ASNs from the ones in the TH's list.
func (tk *TestKeys) analysisDNSDiffASN(
        logger model.Logger,
        probeAddrs,
        thAddrs []string,
        lookupper model.GeoIPASNLookupper,
) (result map[string]uint) {
        const (
                inProbe = 1 << iota
                inTH
        )
        logger.Debugf("DNS: probeAddrs %+v, thAddrs %+v", probeAddrs, thAddrs)
        uniqueAddrs := make(map[string]uint)
        asnToFlags := make(map[uint]int)
        for _, addr := range probeAddrs {
                asn, _, _ := lookupper.LookupASN(addr)
                asnToFlags[asn] |= inProbe // including the zero ASN that means unknown
                uniqueAddrs[addr] = asn
        }
        for _, addr := range thAddrs {
                asn, _, _ := lookupper.LookupASN(addr)
                asnToFlags[asn] |= inTH // including the zero ASN that means unknown
                uniqueAddrs[addr] = asn
        }
        for addr, asn := range uniqueAddrs {
                logger.Infof("DNS: addr %s has AS%d", addr, asn)
        }
        probeOnlyASNs := make(map[uint]bool)
        for asn, where := range asnToFlags {
                if (where & inTH) == 0 {
                        probeOnlyASNs[asn] = true
                }
        }
        for asn := range probeOnlyASNs {
                logger.Infof("DNS: AS%d: only seen by probe", asn)
        }
        result = make(map[string]uint)
        for addr, asn := range uniqueAddrs {
                if probeOnlyASNs[asn] {
                        result[addr] = asn
                }
        }
        return
}

// findAddrsWithoutTLSHandshake computes the list of probe discovered [addresses]
// for which we couldn't successfully perform a TLS handshake for the given [domain].
func (tk *TestKeys) findAddrsWithoutTLSHandshake(domain string, addresses []string) (output []string) {
        const (
                resolvedByProbe = 1 << iota
                handshakeOK
                hasObviousIPv6Issues
        )
        mapping := make(map[string]int)

        // fill the input map with the addresses we're interested to analyze
        for _, addr := range addresses {
                mapping[addr] = 0
        }

        // flag the subset of addresses resolved by the probe
        for _, query := range tk.Queries {
                for _, answer := range query.Answers {
                        var addr string
                        switch answer.AnswerType {
                        case "A":
                                addr = answer.IPv4
                        case "AAAA":
                                addr = answer.IPv6
                        default:
                                continue
                        }
                        if _, found := mapping[addr]; !found {
                                continue // we're not interested into this addr
                        }
                        mapping[addr] |= resolvedByProbe
                }
        }

        // flag the subset of addrs with obvious IPv6 issues
        //
        // see https://github.com/ooni/probe/issues/2284 for more
        // info on why we need to flag them
        for _, connect := range tk.TCPConnect {
                failure := connect.Status.Failure
                if failure == nil {
                        continue // if we can connect, we don't have IPv6 issues
                }
                ipv6, err := netxlite.IsIPv6(connect.IP)
                if err != nil {
                        continue // looks like a bug
                }
                if !ipv6 {
                        continue // not IPv6
                }
                hasIssues := (*failure == netxlite.FailureNetworkUnreachable ||
                        *failure == netxlite.FailureHostUnreachable)
                if hasIssues {
                        mapping[connect.IP] |= hasObviousIPv6Issues
                }
        }

        // flag the subset of addrs with successful handshake for the right SNI
        for _, thx := range tk.TLSHandshakes {
                addr, _, err := net.SplitHostPort(thx.Address)
                if err != nil {
                        continue // looks like a bug
                }
                if thx.Failure != nil {
                        continue // this handshake failed
                }
                if _, found := mapping[addr]; !found {
                        continue // we're not interested into this addr
                }
                if thx.ServerName != domain {
                        continue // the SNI is different, so...
                }
                mapping[addr] |= handshakeOK
        }

        // compute the list of addresses without the handshakeOK flag
        // excluding though the ones with obvious IPv6 issues
        for addr, flags := range mapping {
                if flags == 0 {
                        continue // this looks like a bug
                }
                if (flags & hasObviousIPv6Issues) != 0 {
                        continue // see https://github.com/ooni/probe/issues/2284
                }
                if (flags & (resolvedByProbe | handshakeOK)) == resolvedByProbe {
                        output = append(output, addr)
                }
        }
        return
}

1	package webconnectivitylte
2
3	//
4	// DNS analysis
5	//
6
7	import (
8	"net"
9	"net/url"
10
11	"github.com/ooni/probe-cli/v3/internal/model"
12	"github.com/ooni/probe-cli/v3/internal/netxlite"
13	)
14
15	const (
16	// AnalysisDNSBogon indicates we got any bogon reply
17	AnalysisDNSBogon = 1 << iota
18
19	// AnalysisDNSUnexpectedFailure indicates the TH could
20	// resolve a domain while the probe couldn't
21	AnalysisDNSUnexpectedFailure
22
23	// AnalysisDNSUnexpectedAddrs indicates the TH resolved
24	// different addresses from the probe
25	AnalysisDNSUnexpectedAddrs
26	)
27
28	// analysisDNSToplevel is the toplevel analysis function for DNS results.
29	//
30	// Note: this function DOES NOT consider failed DNS-over-HTTPS (DoH) submeasurements
31	// and ONLY considers the IP addrs they have resolved. Failing to contact a DoH service
32	// provides info about such a DoH service rather than on the measured URL. See the
33	// https://github.com/ooni/probe/issues/2274 issue for more info.
34	//
35	// The goals of this function are the following:
36	//
37	// 1. Set the legacy .DNSExperimentFailure field to the failure value of the
38	// first DNS query that failed among the ones we actually tried. Because we
39	// have multiple queries, unfortunately we are forced to pick one error among
40	// possibly many to assign to this field. This is why I consider it legacy.
41	//
42	// 2. Compute the XDNSFlags value.
43	//
44	// From the XDNSFlags value, we determine, in turn DNSConsistency and
45	// XBlockingFlags according to the following decision table:
46	//
47	// +-----------+----------------+---------------------+
48	// \| XDNSFlags \| DNSConsistency \| XBlockingFlags \|
49	// +-----------+----------------+---------------------+
50	// \| 0 \| "consistent" \| no change \|
51	// +-----------+----------------+---------------------+
52	// \| nonzero \| "inconsistent" \| set FlagDNSBlocking \|
53	// +-----------+----------------+---------------------+
54	//
55	// We explain how XDNSFlags is determined in the documentation of
56	// the functions that this function calls to do its job.
57	func (tk *TestKeys) analysisDNSToplevel(logger model.Logger, lookupper model.GeoIPASNLookupper) {	11✔
58	tk.analysisDNSExperimentFailure()	11✔
59	tk.analysisDNSBogon(logger)	11✔
60	tk.analysisDNSDuplicateResponses(logger)	11✔
61	tk.analysisDNSUnexpectedFailure(logger)	11✔
62	tk.analysisDNSUnexpectedAddrs(logger, lookupper)	11✔
63	if tk.DNSFlags != 0 {	16✔
64	logger.Warn("DNSConsistency: inconsistent")	5✔
65	tk.DNSConsistency = "inconsistent"	5✔
66	tk.BlockingFlags \|= analysisFlagDNSBlocking	5✔
67	} else {	11✔
68	logger.Info("DNSConsistency: consistent")	6✔
69	tk.DNSConsistency = "consistent"	6✔
70	}	6✔
71	}
72
73	// analysisDNSDuplicateResponses checks whether we received duplicate
74	// replies for DNS-over-UDP queries, which is very unexpected.
75	func (tk *TestKeys) analysisDNSDuplicateResponses(logger model.Logger) {	11✔
76	if length := len(tk.DNSDuplicateResponses); length > 0 {	13✔
77	// TODO(bassosimone): write algorithm to analyze this	2✔
78	logger.Warnf("DNS: got %d unexpected late/duplicate DNS responses", length)	2✔
79	}	2✔
80	}
81
82	// analysisDNSExperimentFailure sets the legacy DNSExperimentFailure field.
83	func (tk *TestKeys) analysisDNSExperimentFailure() {	11✔
84	for _, query := range tk.Queries {	48✔
85	if fail := query.Failure; fail != nil {	51✔
86	if query.QueryType == "AAAA" && *query.Failure == netxlite.FailureDNSNoAnswer {	25✔
87	// maybe this heuristic could be further improved by checking	11✔
88	// whether the TH did actually see any IPv6 address?	11✔
89	continue	11✔
90	}
91	if query.Engine == "doh" {	3✔
UNCOV 92	// we SHOULD NOT flag DoH failures _because_ they pertain to the	×
UNCOV 93	// DoH service rather than to the input URL	×
UNCOV 94	//	×
UNCOV 95	// See https://github.com/ooni/probe/issues/2274	×
UNCOV 96	continue	×
97	}
98	tk.DNSExperimentFailure = fail	3✔
99	return	3✔
100	}
101	}
102	}
103
104	// analysisDNSBogon computes the AnalysisDNSBogon flag. We set this flag if
105	// we dectect any bogon in the .Queries field of the TestKeys.
106	func (tk *TestKeys) analysisDNSBogon(logger model.Logger) {	11✔
107	for _, query := range tk.Queries {	52✔
108	// Implementation note: any bogon IP address resolved by a DoH service	41✔
109	// is STILL suspicious since it should not happen. TODO(bassosimone): an	41✔
110	// even better algorithm could possibly check whether also the TH has	41✔
111	// observed bogon IP addrs and avoid flagging in such a case.	41✔
112	//	41✔
113	// See https://github.com/ooni/probe/issues/2274	41✔
114	for _, answer := range query.Answers {	89✔
115	switch answer.AnswerType {	48✔
116	case "A":	37✔
117	if net.ParseIP(answer.IPv4) != nil && netxlite.IsBogon(answer.IPv4) {	37✔
118	logger.Warnf(	×
119	"DNS: got BOGON answer %s for domain %s (see #%d)",	×
120	answer.IPv4,	×
121	query.Hostname,	×
122	query.TransactionID,	×
123	)	×
124	tk.DNSFlags \|= AnalysisDNSBogon	×
125	// continue processing so we print all the bogons we have	×
126	}	×
127	case "AAAA":	8✔
128	if net.ParseIP(answer.IPv6) != nil && netxlite.IsBogon(answer.IPv6) {	8✔
129	logger.Warnf(	×
130	"DNS: got BOGON answer %s for domain %s (see #%d)",	×
131	answer.IPv6,	×
132	query.Hostname,	×
133	query.TransactionID,	×
134	)	×
135	tk.DNSFlags \|= AnalysisDNSBogon	×
136	// continue processing so we print all the bogons we have	×
137	}	×
138	default:	3✔
139	// nothing
140	}
141	}
142	}
143	}
144
145	// analysisDNSUnexpectedFailure computes the AnalysisDNSUnexpectedFailure flags. We say
146	// a failure is unexpected when the TH could resolve a domain and the probe couldn't.
147	func (tk *TestKeys) analysisDNSUnexpectedFailure(logger model.Logger) {	11✔
148	// make sure we have control before proceeding futher	11✔
149	if tk.Control == nil \|\| tk.ControlRequest == nil {	11✔
150	return	×
151	}	×
152
153	// obtain thRequest and thResponse as shortcuts
154	thRequest := tk.ControlRequest	11✔
155	thResponse := tk.Control	11✔
156		11✔
157	// obtain the domain that the TH has queried for	11✔
158	URL, err := url.Parse(thRequest.HTTPRequest)	11✔
159	if err != nil {	11✔
160	return // this looks like a bug	×
161	}	×
162	domain := URL.Hostname()	11✔
163		11✔
164	// we obviously don't care if the domain was an IP adddress	11✔
165	if net.ParseIP(domain) != nil {	11✔
166	return	×
167	}	×
168
169	// if the control didn't lookup any IP addresses our job here is done
170	// because we can't say whether we have unexpected failures
171	hasAddrs := len(thResponse.DNS.Addrs) > 0	11✔
172	if !hasAddrs {	12✔
173	return	1✔
174	}	1✔
175
176	// with TH-resolved addrs, any local query _for the same domain_ queried
177	// by the probe that contains an error is suspicious
178	for _, query := range tk.Queries {	48✔
179	if domain != query.Hostname {	44✔
180	continue // not the domain queried by the test helper	6✔
181	}
182	if query.Engine == "doh" {	34✔
183	// As mentioned above, a DoH failure is not information about	2✔
184	// the URL we're measuring but about the DoH service being blocked.	2✔
185	//	2✔
186	// See https://github.com/ooni/probe/issues/2274	2✔
187	continue	2✔
188	}
189	hasAddrs := false	30✔
190	Loop:	30✔
191	for _, answer := range query.Answers {	57✔
192	switch answer.AnswerType {	27✔
193	case "A", "AAA":	18✔
194	hasAddrs = true	18✔
195	break Loop	18✔
196	}
197	}
198	if hasAddrs {	48✔
199	// if the lookup returned any IP address, we are	18✔
200	// not dealing with unexpected failures	18✔
201	continue	18✔
202	}
203	if query.Failure == nil {	13✔
204	// we expect to see a failure if we don't see	1✔
205	// answers, so this seems a bug?	1✔
206	continue	1✔
207	}
208	if query.QueryType == "AAAA" && *query.Failure == netxlite.FailureDNSNoAnswer {	20✔
209	// maybe this heuristic could be further improved by checking	9✔
210	// whether the TH did actually see any IPv6 address?	9✔
211	continue	9✔
212	}
213	logger.Warnf("DNS: unexpected failure %s in #%d", *query.Failure, query.TransactionID)	2✔
214	tk.DNSFlags \|= AnalysisDNSUnexpectedFailure	2✔
215	// continue processing so we print all the unexpected failures
216
217	// TODO(https://github.com/ooni/probe/issues/2029#issuecomment-1411716295): we need
218	// to ensure we correctly handle the android_dns_cache_no_data case.
219	}
220	}
221
222	// analysisDNSUnexpectedAddrs computes the AnalysisDNSUnexpectedAddrs flags. This
223	// algorithm builds upon the original DNSDiff algorithm by introducing an additional
224	// TLS based heuristic for determining whether an IP address was legit.
225	func (tk *TestKeys) analysisDNSUnexpectedAddrs(
226	logger model.Logger,
227	lookupper model.GeoIPASNLookupper,
228	) {	11✔
229	// make sure we have control before proceeding futher	11✔
230	if tk.Control == nil \|\| tk.ControlRequest == nil {	11✔
231	return	×
232	}	×
233
234	// obtain thRequest and thResponse as shortcuts
235	thRequest := tk.ControlRequest	11✔
236	thResponse := tk.Control	11✔
237		11✔
238	// obtain the domain that the TH has queried for	11✔
239	URL, err := url.Parse(thRequest.HTTPRequest)	11✔
240	if err != nil {	11✔
241	return // this looks like a bug	×
242	}	×
243	domain := URL.Hostname()	11✔
244		11✔
245	// we obviously don't care if the domain was an IP adddress	11✔
246	if net.ParseIP(domain) != nil {	11✔
247	return	×
248	}	×
249
250	// if the control didn't resolve any IP address, then we basically
251	// cannot run this algorithm at all
252	thAddrs := thResponse.DNS.Addrs	11✔
253	if len(thAddrs) <= 0 {	12✔
254	return	1✔
255	}	1✔
256
257	// gather all the IP addresses queried by the probe
258	// for the same domain for which the TH queried.
259	var probeAddrs []string	10✔
260	for _, query := range tk.Queries {	48✔
261	if domain != query.Hostname {	44✔
262	continue // not the domain the TH queried for	6✔
263	}
264	// Implementation note: in the case in which DoH returned answers, here
265	// it still feels okay to consider them. We should avoid flagging DoH
266	// failures as measurement failures but if DoH returns us some unexpected
267	// even-non-bogon addr, it seems worth flagging for now.
268	//
269	// See https://github.com/ooni/probe/issues/2274
270	for _, answer := range query.Answers {	76✔
271	switch answer.AnswerType {	44✔
272	case "A":	33✔
273	probeAddrs = append(probeAddrs, answer.IPv4)	33✔
274	case "AAAA":	8✔
275	probeAddrs = append(probeAddrs, answer.IPv6)	8✔
276	}
277	}
278	}
279
280	// if the probe has not collected any addr for the same domain, it's
281	// definitely suspicious and counts as a difference
282	if len(probeAddrs) <= 0 {	10✔
283	logger.Warnf("DNS: the probe did not resolve any IP address")	×
284	tk.DNSFlags \|= AnalysisDNSUnexpectedAddrs	×
285	return	×
286	}	×
287
288	// if there are no different addresses between the probe and the TH then
289	// our job here is done and we can just stop searching
290	differentAddrs := tk.analysisDNSDiffAddrs(probeAddrs, thAddrs)	10✔
291	if len(differentAddrs) <= 0 {	17✔
292	return	7✔
293	}	7✔
294	for _, addr := range differentAddrs {	26✔
295	logger.Infof("DNS: address %s: not resolved by TH", addr)	23✔
296	}	23✔
297
298	// now, let's exclude the differentAddrs for which we successfully
299	// completed a TLS handshake: those should be good addrs
300	withoutHandshake := tk.findAddrsWithoutTLSHandshake(domain, differentAddrs)	3✔
301	if len(withoutHandshake) <= 0 {	3✔
302	return	×
303	}	×
304	for _, addr := range withoutHandshake {	18✔
305	logger.Infof("DNS: address %s: cannot confirm using TLS handshake", addr)	15✔
306	}	15✔
307
308	// as a last resort, accept the addresses without an handshake whose
309	// ASN overlaps with ASNs resolved by the TH
310	differentASNs := tk.analysisDNSDiffASN(logger, withoutHandshake, thAddrs, lookupper)	3✔
311	if len(differentASNs) <= 0 {	3✔
312	return	×
313	}	×
314
315	// otherwise, conclude we have unexpected probe addrs
316	for addr, asn := range differentASNs {	18✔
317	logger.Warnf(	15✔
318	"DNS: address %s has unexpected AS%d and we cannot use TLS to confirm it",	15✔
319	addr, asn,	15✔
320	)	15✔
321	}	15✔
322	tk.DNSFlags \|= AnalysisDNSUnexpectedAddrs	3✔
323	}
324
325	// analysisDNSDiffAddrs returns all the IP addresses that are
326	// resolved by the probe but not by the test helper.
327	func (tk *TestKeys) analysisDNSDiffAddrs(probeAddrs, thAddrs []string) (diff []string) {	10✔
328	const (	10✔
329	inProbe = 1 << iota	10✔
330	inTH	10✔
331	)	10✔
332	mapping := make(map[string]int)	10✔
333	for _, addr := range probeAddrs {	51✔
334	if net.ParseIP(addr) != nil && netxlite.IsBogon(addr) {	41✔
335	// we can exclude bogons from the analysis because we already analyzed them	×
336	continue	×
337	}
338	mapping[addr] \|= inProbe	41✔
339	}
340	for _, addr := range thAddrs {	35✔
341	mapping[addr] = inTH	25✔
342	}	25✔
343	for addr, where := range mapping {	58✔
344	if (where & inTH) == 0 {	71✔
345	diff = append(diff, addr)	23✔
346	}	23✔
347	}
348	return	10✔
349	}
350
351	// analysisDNSDiffASN returns whether there are IP addresses in the probe's
352	// list with different ASNs from the ones in the TH's list.
353	func (tk *TestKeys) analysisDNSDiffASN(
354	logger model.Logger,
355	probeAddrs,
356	thAddrs []string,
357	lookupper model.GeoIPASNLookupper,
358	) (result map[string]uint) {	3✔
359	const (	3✔
360	inProbe = 1 << iota	3✔
361	inTH	3✔
362	)	3✔
363	logger.Debugf("DNS: probeAddrs %+v, thAddrs %+v", probeAddrs, thAddrs)	3✔
364	uniqueAddrs := make(map[string]uint)	3✔
365	asnToFlags := make(map[uint]int)	3✔
366	for _, addr := range probeAddrs {	18✔
367	asn, _, _ := lookupper.LookupASN(addr)	15✔
368	asnToFlags[asn] \|= inProbe // including the zero ASN that means unknown	15✔
369	uniqueAddrs[addr] = asn	15✔
370	}	15✔
371	for _, addr := range thAddrs {	21✔
372	asn, _, _ := lookupper.LookupASN(addr)	18✔
373	asnToFlags[asn] \|= inTH // including the zero ASN that means unknown	18✔
374	uniqueAddrs[addr] = asn	18✔
375	}	18✔
376	for addr, asn := range uniqueAddrs {	36✔
377	logger.Infof("DNS: addr %s has AS%d", addr, asn)	33✔
378	}	33✔
379	probeOnlyASNs := make(map[uint]bool)	3✔
380	for asn, where := range asnToFlags {	9✔
381	if (where & inTH) == 0 {	9✔
382	probeOnlyASNs[asn] = true	3✔
383	}	3✔
384	}
385	for asn := range probeOnlyASNs {	6✔
386	logger.Infof("DNS: AS%d: only seen by probe", asn)	3✔
387	}	3✔
388	result = make(map[string]uint)	3✔
389	for addr, asn := range uniqueAddrs {	36✔
390	if probeOnlyASNs[asn] {	48✔
391	result[addr] = asn	15✔
392	}	15✔
393	}
394	return	3✔
395	}
396
397	// findAddrsWithoutTLSHandshake computes the list of probe discovered [addresses]
398	// for which we couldn't successfully perform a TLS handshake for the given [domain].
399	func (tk *TestKeys) findAddrsWithoutTLSHandshake(domain string, addresses []string) (output []string) {	3✔
400	const (	3✔
401	resolvedByProbe = 1 << iota	3✔
402	handshakeOK	3✔
403	hasObviousIPv6Issues	3✔
404	)	3✔
405	mapping := make(map[string]int)	3✔
406		3✔
407	// fill the input map with the addresses we're interested to analyze	3✔
408	for _, addr := range addresses {	26✔
409	mapping[addr] = 0	23✔
410	}	23✔
411
412	// flag the subset of addresses resolved by the probe
413	for _, query := range tk.Queries {	14✔
414	for _, answer := range query.Answers {	43✔
415	var addr string	32✔
416	switch answer.AnswerType {	32✔
417	case "A":	21✔
418	addr = answer.IPv4	21✔
419	case "AAAA":	8✔
420	addr = answer.IPv6	8✔
421	default:	3✔
422	continue	3✔
423	}
424	if _, found := mapping[addr]; !found {	30✔
425	continue // we're not interested into this addr	1✔
426	}
427	mapping[addr] \|= resolvedByProbe	28✔
428	}
429	}
430
431	// flag the subset of addrs with obvious IPv6 issues
432	//
433	// see https://github.com/ooni/probe/issues/2284 for more
434	// info on why we need to flag them
435	for _, connect := range tk.TCPConnect {	44✔
436	failure := connect.Status.Failure	41✔
437	if failure == nil {	66✔
438	continue // if we can connect, we don't have IPv6 issues	25✔
439	}
440	ipv6, err := netxlite.IsIPv6(connect.IP)	16✔
441	if err != nil {	16✔
442	continue // looks like a bug	×
443	}
444	if !ipv6 {	16✔
445	continue // not IPv6	×
446	}
447	hasIssues := (*failure == netxlite.FailureNetworkUnreachable \|\|	16✔
448	*failure == netxlite.FailureHostUnreachable)	16✔
449	if hasIssues {	32✔
450	mapping[connect.IP] \|= hasObviousIPv6Issues	16✔
451	}	16✔
452	}
453
454	// flag the subset of addrs with successful handshake for the right SNI
455	for _, thx := range tk.TLSHandshakes {	28✔
456	addr, _, err := net.SplitHostPort(thx.Address)	25✔
457	if err != nil {	25✔
458	continue // looks like a bug	×
459	}
460	if thx.Failure != nil {	49✔
461	continue // this handshake failed	24✔
462	}
463	if _, found := mapping[addr]; !found {	2✔
464	continue // we're not interested into this addr	1✔
465	}
466	if thx.ServerName != domain {	×
467	continue // the SNI is different, so...	×
468	}
469	mapping[addr] \|= handshakeOK	×
470	}
471
472	// compute the list of addresses without the handshakeOK flag
473	// excluding though the ones with obvious IPv6 issues
474	for addr, flags := range mapping {	34✔
475	if flags == 0 {	31✔
476	continue // this looks like a bug	×
477	}
478	if (flags & hasObviousIPv6Issues) != 0 {	47✔
479	continue // see https://github.com/ooni/probe/issues/2284	16✔
480	}
481	if (flags & (resolvedByProbe \| handshakeOK)) == resolvedByProbe {	30✔
482	output = append(output, addr)	15✔
483	}	15✔
484	}
485	return	3✔
486	}

ooni / probe-cli / 6156851663

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous