Linux Kernel  3.7.1
 All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
dns_key.c
Go to the documentation of this file.
1 /* Key type used to cache DNS lookups made by the kernel
2  *
3  * See Documentation/networking/dns_resolver.txt
4  *
5  * Copyright (c) 2007 Igor Mammedov
6  * Author(s): Igor Mammedov ([email protected])
7  * Steve French ([email protected])
8  * Wang Lei ([email protected])
9  * David Howells ([email protected])
10  *
11  * This library is free software; you can redistribute it and/or modify
12  * it under the terms of the GNU Lesser General Public License as published
13  * by the Free Software Foundation; either version 2.1 of the License, or
14  * (at your option) any later version.
15  *
16  * This library is distributed in the hope that it will be useful,
17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
19  * the GNU Lesser General Public License for more details.
20  *
21  * You should have received a copy of the GNU Lesser General Public License
22  * along with this library; if not, write to the Free Software
23  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
24  */
25 #include <linux/module.h>
26 #include <linux/moduleparam.h>
27 #include <linux/slab.h>
28 #include <linux/string.h>
29 #include <linux/kernel.h>
30 #include <linux/keyctl.h>
31 #include <linux/err.h>
32 #include <linux/seq_file.h>
33 #include <keys/dns_resolver-type.h>
34 #include <keys/user-type.h>
35 #include "internal.h"
36 
37 MODULE_DESCRIPTION("DNS Resolver");
38 MODULE_AUTHOR("Wang Lei");
39 MODULE_LICENSE("GPL");
40 
41 unsigned int dns_resolver_debug;
43 MODULE_PARM_DESC(debug, "DNS Resolver debugging mask");
44 
45 const struct cred *dns_resolver_cache;
46 
47 #define DNS_ERRORNO_OPTION "dnserror"
48 
49 /*
50  * Instantiate a user defined key for dns_resolver.
51  *
52  * The data must be a NUL-terminated string, with the NUL char accounted in
53  * datalen.
54  *
55  * If the data contains a '#' characters, then we take the clause after each
56  * one to be an option of the form 'key=value'. The actual data of interest is
57  * the string leading up to the first '#'. For instance:
58  *
59  * "ip1,ip2,...#foo=bar"
60  */
61 static int
62 dns_resolver_instantiate(struct key *key, struct key_preparsed_payload *prep)
63 {
64  struct user_key_payload *upayload;
65  unsigned long derrno;
66  int ret;
67  size_t datalen = prep->datalen, result_len = 0;
68  const char *data = prep->data, *end, *opt;
69 
70  kenter("%%%d,%s,'%*.*s',%zu",
71  key->serial, key->description,
72  (int)datalen, (int)datalen, data, datalen);
73 
74  if (datalen <= 1 || !data || data[datalen - 1] != '\0')
75  return -EINVAL;
76  datalen--;
77 
78  /* deal with any options embedded in the data */
79  end = data + datalen;
80  opt = memchr(data, '#', datalen);
81  if (!opt) {
82  /* no options: the entire data is the result */
83  kdebug("no options");
84  result_len = datalen;
85  } else {
86  const char *next_opt;
87 
88  result_len = opt - data;
89  opt++;
90  kdebug("options: '%s'", opt);
91  do {
92  const char *eq;
93  int opt_len, opt_nlen, opt_vlen, tmp;
94 
95  next_opt = memchr(opt, '#', end - opt) ?: end;
96  opt_len = next_opt - opt;
97  if (!opt_len) {
99  "Empty option to dns_resolver key %d\n",
100  key->serial);
101  return -EINVAL;
102  }
103 
104  eq = memchr(opt, '=', opt_len) ?: end;
105  opt_nlen = eq - opt;
106  eq++;
107  opt_vlen = next_opt - eq; /* will be -1 if no value */
108 
109  tmp = opt_vlen >= 0 ? opt_vlen : 0;
110  kdebug("option '%*.*s' val '%*.*s'",
111  opt_nlen, opt_nlen, opt, tmp, tmp, eq);
112 
113  /* see if it's an error number representing a DNS error
114  * that's to be recorded as the result in this key */
115  if (opt_nlen == sizeof(DNS_ERRORNO_OPTION) - 1 &&
116  memcmp(opt, DNS_ERRORNO_OPTION, opt_nlen) == 0) {
117  kdebug("dns error number option");
118  if (opt_vlen <= 0)
119  goto bad_option_value;
120 
121  ret = strict_strtoul(eq, 10, &derrno);
122  if (ret < 0)
123  goto bad_option_value;
124 
125  if (derrno < 1 || derrno > 511)
126  goto bad_option_value;
127 
128  kdebug("dns error no. = %lu", derrno);
129  key->type_data.x[0] = -derrno;
130  continue;
131  }
132 
133  bad_option_value:
135  "Option '%*.*s' to dns_resolver key %d:"
136  " bad/missing value\n",
137  opt_nlen, opt_nlen, opt, key->serial);
138  return -EINVAL;
139  } while (opt = next_opt + 1, opt < end);
140  }
141 
142  /* don't cache the result if we're caching an error saying there's no
143  * result */
144  if (key->type_data.x[0]) {
145  kleave(" = 0 [h_error %ld]", key->type_data.x[0]);
146  return 0;
147  }
148 
149  kdebug("store result");
150  ret = key_payload_reserve(key, result_len);
151  if (ret < 0)
152  return -EINVAL;
153 
154  upayload = kmalloc(sizeof(*upayload) + result_len + 1, GFP_KERNEL);
155  if (!upayload) {
156  kleave(" = -ENOMEM");
157  return -ENOMEM;
158  }
159 
160  upayload->datalen = result_len;
161  memcpy(upayload->data, data, result_len);
162  upayload->data[result_len] = '\0';
163  rcu_assign_pointer(key->payload.data, upayload);
164 
165  kleave(" = 0");
166  return 0;
167 }
168 
169 /*
170  * The description is of the form "[<type>:]<domain_name>"
171  *
172  * The domain name may be a simple name or an absolute domain name (which
173  * should end with a period). The domain name is case-independent.
174  */
175 static int
176 dns_resolver_match(const struct key *key, const void *description)
177 {
178  int slen, dlen, ret = 0;
179  const char *src = key->description, *dsp = description;
180 
181  kenter("%s,%s", src, dsp);
182 
183  if (!src || !dsp)
184  goto no_match;
185 
186  if (strcasecmp(src, dsp) == 0)
187  goto matched;
188 
189  slen = strlen(src);
190  dlen = strlen(dsp);
191  if (slen <= 0 || dlen <= 0)
192  goto no_match;
193  if (src[slen - 1] == '.')
194  slen--;
195  if (dsp[dlen - 1] == '.')
196  dlen--;
197  if (slen != dlen || strncasecmp(src, dsp, slen) != 0)
198  goto no_match;
199 
200 matched:
201  ret = 1;
202 no_match:
203  kleave(" = %d", ret);
204  return ret;
205 }
206 
207 /*
208  * Describe a DNS key
209  */
210 static void dns_resolver_describe(const struct key *key, struct seq_file *m)
211 {
212  int err = key->type_data.x[0];
213 
214  seq_puts(m, key->description);
215  if (key_is_instantiated(key)) {
216  if (err)
217  seq_printf(m, ": %d", err);
218  else
219  seq_printf(m, ": %u", key->datalen);
220  }
221 }
222 
223 /*
224  * read the DNS data
225  * - the key's semaphore is read-locked
226  */
227 static long dns_resolver_read(const struct key *key,
228  char __user *buffer, size_t buflen)
229 {
230  if (key->type_data.x[0])
231  return key->type_data.x[0];
232 
233  return user_read(key, buffer, buflen);
234 }
235 
236 struct key_type key_type_dns_resolver = {
237  .name = "dns_resolver",
238  .instantiate = dns_resolver_instantiate,
239  .match = dns_resolver_match,
240  .revoke = user_revoke,
241  .destroy = user_destroy,
242  .describe = dns_resolver_describe,
243  .read = dns_resolver_read,
244 };
245 
246 static int __init init_dns_resolver(void)
247 {
248  struct cred *cred;
249  struct key *keyring;
250  int ret;
251 
252  /* create an override credential set with a special thread keyring in
253  * which DNS requests are cached
254  *
255  * this is used to prevent malicious redirections from being installed
256  * with add_key().
257  */
258  cred = prepare_kernel_cred(NULL);
259  if (!cred)
260  return -ENOMEM;
261 
262  keyring = key_alloc(&key_type_keyring, ".dns_resolver",
264  (KEY_POS_ALL & ~KEY_POS_SETATTR) |
265  KEY_USR_VIEW | KEY_USR_READ,
266  KEY_ALLOC_NOT_IN_QUOTA);
267  if (IS_ERR(keyring)) {
268  ret = PTR_ERR(keyring);
269  goto failed_put_cred;
270  }
271 
272  ret = key_instantiate_and_link(keyring, NULL, 0, NULL, NULL);
273  if (ret < 0)
274  goto failed_put_key;
275 
276  ret = register_key_type(&key_type_dns_resolver);
277  if (ret < 0)
278  goto failed_put_key;
279 
280  /* instruct request_key() to use this special keyring as a cache for
281  * the results it looks up */
282  set_bit(KEY_FLAG_ROOT_CAN_CLEAR, &keyring->flags);
283  cred->thread_keyring = keyring;
284  cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
285  dns_resolver_cache = cred;
286 
287  kdebug("DNS resolver keyring: %d\n", key_serial(keyring));
288  return 0;
289 
290 failed_put_key:
291  key_put(keyring);
292 failed_put_cred:
293  put_cred(cred);
294  return ret;
295 }
296 
297 static void __exit exit_dns_resolver(void)
298 {
299  key_revoke(dns_resolver_cache->thread_keyring);
300  unregister_key_type(&key_type_dns_resolver);
301  put_cred(dns_resolver_cache);
302 }
303 
304 module_init(init_dns_resolver)
305 module_exit(exit_dns_resolver)
306 MODULE_LICENSE("GPL");