app: dns.canary probe — client half of the canary measurement, verified live

Resolves the server's canary zone through the platform resolver and compares against the spec-frozen ground truth (probe-protocol §6.1): reference records detect answers rewritten in flight, and a per-run nonce name (uncacheable) proves the query reached the authoritative server. Findings: dns.answer_rewritten (high), dns.authoritative_unreachable (medium). Verified on the OnePlus against the deployed fmr zone: 4/4 reference records matched exactly, nonce name answered 192.0.2.21 with reached_authoritative=true. First full client<->server measurement loop on real hardware; report archived. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-01 09:02:43 +02:00
parent cf5cd2dc68
commit 59ba1c16bc
23 changed files with 2170 additions and 0 deletions
@@ -0,0 +1,111 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package app.echo_lot.probe
+
+import android.content.Context
+import app.echo_lot.measurement.Test
+import app.echo_lot.measurement.TestStatus
+import app.echo_lot.measurement.TestType
+import app.echo_lot.measurement.Tier
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.buildJsonObject
+import kotlinx.serialization.json.put
+import kotlinx.serialization.json.putJsonObject
+import java.net.InetAddress
+
+/**
+ * dns.canary / dns.answer_integrity — resolves the server's canary zone through the network's own
+ * resolver and compares against the spec-frozen ground truth (probe-protocol.md §6.1).
+ *
+ * Two things are checked, and they detect different failures:
+ *  - **Reference records** (`ttl-5`, `many-rr`, …) have FIXED RDATA fixed by the spec, so a
+ *    mismatch means the answer was rewritten in flight (interception/filtering).
+ *  - A **per-run nonce name** `<nonce>.<session>.<zone>` can never have been cached, so it proves
+ *    the query reached the authoritative server, and the answer is derived from the nonce itself.
+ *
+ * Resolution goes through the platform resolver (InetAddress), i.e. exactly the path apps use —
+ * so interception by the network's DNS is what we measure. The server side records who actually
+ * asked (its observation API), letting the app pair "what I got" with "who asked".
+ */
+class DnsCanaryProbe(
+    private val canaryZone: String,
+    private val sessionPrefix: String,
+    private val nonce: String = java.util.UUID.randomUUID().toString().take(8),
+) : Probe {
+    override val type = TestType.DNS_CANARY
+    override val tier = Tier.APP
+
+    /** Frozen ground truth from probe-protocol.md §6.1 — must match the server's dns_reference.go. */
+    private val references = listOf(
+        Reference("ttl-5", "192.0.2.5"),
+        Reference("ttl-60", "192.0.2.60"),
+        Reference("ttl-3600", "192.0.2.36"),
+        Reference("ttl-86400", "192.0.2.86"),
+    )
+
+    private data class Reference(val label: String, val expectedA: String)
+
+    override suspend fun run(ctx: Context, ids: ProbeIds): Test = withContext(Dispatchers.IO) {
+        val b = TestBuilder(type, tier, ids)
+        if (canaryZone.isBlank()) {
+            return@withContext b.build(
+                TestStatus.SKIPPED,
+                evidence = buildJsonObject { put("reason", "no canary zone configured (needs a server profile)") },
+            )
+        }
+
+        var matched = 0
+        var mismatched = 0
+        var failed = 0
+
+        val evidence: JsonObject = buildJsonObject {
+            put("zone", canaryZone)
+            putJsonObject("reference_records") {
+                for (r in references) {
+                    val fqdn = "${r.label}.$canaryZone"
+                    val got = resolveA(fqdn)
+                    putJsonObject(r.label) {
+                        put("fqdn", fqdn); put("expected", r.expectedA); put("got", got ?: "")
+                        val verdict = when {
+                            got == null -> { failed++; "resolve_failed" }
+                            got == r.expectedA -> { matched++; "match" }
+                            else -> { mismatched++; "MISMATCH (answer rewritten in flight)" }
+                        }
+                        put("verdict", verdict)
+                    }
+                }
+            }
+            // Cache-miss proof: a nonce name that cannot have been pre-cached.
+            val nonceFqdn = "$nonce.$sessionPrefix.$canaryZone"
+            val nonceGot = resolveA(nonceFqdn)
+            putJsonObject("nonce_query") {
+                put("fqdn", nonceFqdn)
+                put("got", nonceGot ?: "")
+                // The server answers nonce names from 192.0.2.0/24 (deterministic per nonce).
+                val reached = nonceGot?.startsWith("192.0.2.") == true
+                put("reached_authoritative", reached)
+                put("note", "a non-192.0.2.x answer means something other than the canary server replied")
+            }
+        }
+
+        val metrics = buildJsonObject {
+            put("references_matched", matched); put("references_mismatched", mismatched)
+            put("references_failed", failed)
+        }
+        val status = when {
+            mismatched > 0 -> TestStatus.PARTIAL   // answers altered — a finding
+            matched == 0 -> TestStatus.FAILED      // nothing resolved
+            failed > 0 -> TestStatus.PARTIAL
+            else -> TestStatus.OK
+        }
+        b.build(status, evidence = evidence, metrics = metrics)
+    }
+
+    /** First IPv4 answer via the platform resolver (the path a normal app takes), or null. */
+    private fun resolveA(fqdn: String): String? = runCatching {
+        InetAddress.getAllByName(fqdn).firstOrNull { it is java.net.Inet4Address }?.hostAddress
+    }.getOrNull()
+}