How to provide global HttpDNS service for Android applications

With the help of the CONNECT method in the NDK, the HOOK implementation handles domain name resolution (see Android hacking: Hooking system functions used by Dalvik), and we have been using HttpDNS in this way for a long time. However, since Android 7.0, the system will prevent applications from dynamically linking to non-public NDK libraries. This library may cause your application to crash. See Android 7.0 behavior Changes.

The behavior that the application is expected to display based on the proprietary native library it uses and the level of the target API (Android :targetSdkVersion)

To sum up, starting from Android 7.0, if the Target API is less than or equal to 23, the first time the app is launched, the Toast prompt will be displayed. If the Target API is greater than or equal to 24, the Toast prompt will be displayed. Then Crash.

Although our Target API is only 23 at present, only Toast will pop up on some mobile phones, but sooner or later we will face the problem of Crash mentioned above, so we began to explore new ways to Hook. The Native layer cannot work, so we have to find a new way in the Java layer.

OkHttp opens the DNS interface as shown in the following code. We can set up a custom DNS service for each OkHttpClient. If none is set, OkHttpClient will use a default DNS service.

We can set up our HttpDNS service for each OkHttpClient, but this approach is not a permanent one. We need to manually modify each additional OkHttpClient, and there is nothing we can do about the OkHttpClient in the third party library. Another way to think about it is to replace the default Dns implementation, dns. SYSTEM, with reflection, once and for all.

Here is the code for the Dns interface

/** * A domain name service that resolves IP addresses for host names. Most applications will use the * {@linkplain #SYSTEM system DNS service}, which is the default. Some applications may provide * their own implementation to use a different DNS server, to prefer IPv6 addresses, to prefer IPv4 * addresses, or to force a specific known IP address. * * <p>Implementations of this interface must be safe for concurrent use. */ public interface Dns { /** * A DNS that uses {@link InetAddress#getAllByName} to ask the underlying operating system to * lookup IP addresses. Most custom {@link Dns} implementations should delegate to this instance. */ Dns SYSTEM = new Dns() { @Override public List<InetAddress> lookup(String hostname) throws UnknownHostException { if (hostname == null) throw new UnknownHostException("hostname == null"); return Arrays.asList(InetAddress.getAllByName(hostname)); }}; /** * Returns the IP addresses of {@code hostname}, in the order they will be attempted by OkHttp. If * a connection to an address fails, OkHttp will retry the connection with the next address until * either a connection is made, the set of IP addresses is exhausted, or a limit is exceeded. */ List<InetAddress> lookup(String hostname) throws UnknownHostException; }Copy the code

The responsibility of URLStreamHandler is primarily to build URLConnection. One other thing we can notice in the getURLStreamHandler code above is that there is a factory implementation of URLStreamHandler, URLStreamHandlerFactory Factory, which is null by default, If we give it an implementation, we can let the system get our custom URLStreamHandler through this factory, which is the key to handling all httpurLConnections uniformly. We simply provide our system with a custom URLStreamHandlerFactory that returns a custom URLStreamHandler that returns the URLConnection for which we provided the HttpDNS service.

Now that we have a rough idea of how to handle all HttpurlConnections uniformly, there are two questions to consider:

• 1, how to implement a customURLStreamHandlerFactory
• 2. Which version of OkHttp does Android use?

For details on how to implement a custom URLStreamHandlerFactory, see the OkHttp module called okHTTP-URlConnection. This module builds an OKHTTP-based URLStreamHandlerFactory.

In a custom factory, we can set up a custom DNS service for OkhttpClient, so we can set up a custom DNS service for OkhttpClient as before, and we will implement the global HttpDNS service for HttpURLConenction.

Also, the core code for the okHTTP-urlConnection module is marked deprecated.

/**
 * @deprecated OkHttp will be dropping its ability to be used with {@link HttpURLConnection} in an
 * upcoming release. Applications that need this should either downgrade to the system's built-in
 * {@link HttpURLConnection} or upgrade to OkHttp's Request/Response API.
 */
public final class OkUrlFactory implements URLStreamHandlerFactory, Cloneable {
    //...
}Copy the code

Rest assured, we found, on the external AOSP/okhttp mentioned com. Android. Okhttp. An HttpHandler as well as the implementation of the principle, so it seems, still can continue to use this way. Deprecated as mentioned above, not because the interface is unstable, but because OkHttp officials want amway to use the standard OkHttp API.

Another question, which version of OkHttp will the Android system use? The following is the latest version of OkHttp on the AOSP Master branch as of now

Which version of OkHttp is used by AOSP

The Android Framework uses only OkHttp2.6. For some reason, the OkHttp version has not been updated. Take a look at OkHttp changelog. md, which has been updated from version 2.6 to the latest stable version 3.8.1. A number of bugfixes and features have been added to improve stability. So, if we provide a custom URLStreamHandlerFactory for our application, we have the added benefit of enabling HttpURLConnection to get the latest Okhttp optimizations.

In addition, there are many other things you can do, such as using Interceptors based on the responsibility chain mechanism to do Http traffic capture tool, or Http traffic monitoring tool, see Chuck.

So far, we have been able to handle all Http traffic by adding an HttpDNS service to it. Although this has satisfied our business, it is not enough. As a general solution, we need to provide an HttpDNS service for TCP traffic, that is, how to handle all Socket DNS. If a unified HttpDNS service is provided for sockets, there is no need to handle DNS for Http traffic.

Just a little bit about the potholes

1. The X509TrustManager fails to be obtained

If only SSLSocketFactory is set, OkHttp will attempt to reflect an X509TrustManager. Sun. Security. SSL. SSLContextImpl on Android doesn’t exist, so eventually throw Unable to extract the trust manager Crash.

public Builder sslSocketFactory(SSLSocketFactory sslSocketFactory) { if (sslSocketFactory == null) throw new NullPointerException("sslSocketFactory == null"); X509TrustManager trustManager = Platform.get().trustManager(sslSocketFactory); if (trustManager == null) { throw new IllegalStateException("Unable to extract the trust manager on " + Platform.get() +  ", sslSocketFactory is " + sslSocketFactory.getClass()); } this.sslSocketFactory = sslSocketFactory; this.certificateChainCleaner = CertificateChainCleaner.get(trustManager); return this; } // Platform.get(). TrustManager method public X509TrustManager trustManager(SSLSocketFactory SSLSocketFactory) {// Attempt to get the trust manager from an OpenJDK socket factory. We attempt this on all // platforms in order to support  Robolectric, which mixes classes from both Android and the // Oracle JDK. Note that we don't support HTTP/2 or other nice features on  Robolectric. try { Class<? > sslContextClass = Class.forName("sun.security.ssl.SSLContextImpl"); Object context = readFieldOrNull(sslSocketFactory, sslContextClass, "context"); if (context == null) return null; return readFieldOrNull(context, X509TrustManager.class, "trustManager"); } catch (ClassNotFoundException e) { return null; }}Copy the code

To solve this problem, you should rewrite the OkHttpsURLConnection class in okHTTP-URlConnection to make the following changes

@Override public void setSSLSocketFactory(SSLSocketFactory sslSocketFactory) { // This fails in JDK 9 because OkHttp is unable to extract the trust manager. delegate.client = delegate.client.newBuilder() .sslSocketFactory(sslSocketFactory) SslSocketFactory (sslSocketFactory, yourTrustManager).build(); }Copy the code

2. Proxy authentication

The authentication information of OkHttp to Proxy is obtained through a customized Authenticator interface rather than from the header. Therefore, you need to add an Authenticator to OkHttpClient for Proxy authentication when setting the authentication information of Proxy.

3. Endless loops

If your HttpDNS query interface is directly connected to the IP address, then there is no problem, can skip, if the domain name is accessed through the HttpDNS, then you need to pay attention to the domain name, otherwise it will fall into an infinite loop.