Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 1 | /* Key type used to cache DNS lookups made by the kernel |
| 2 | * |
| 3 | * See Documentation/networking/dns_resolver.txt |
| 4 | * |
| 5 | * Copyright (c) 2007 Igor Mammedov |
| 6 | * Author(s): Igor Mammedov (niallain@gmail.com) |
| 7 | * Steve French (sfrench@us.ibm.com) |
| 8 | * Wang Lei (wang840925@gmail.com) |
| 9 | * David Howells (dhowells@redhat.com) |
| 10 | * |
| 11 | * This library is free software; you can redistribute it and/or modify |
| 12 | * it under the terms of the GNU Lesser General Public License as published |
| 13 | * by the Free Software Foundation; either version 2.1 of the License, or |
| 14 | * (at your option) any later version. |
| 15 | * |
| 16 | * This library is distributed in the hope that it will be useful, |
| 17 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 18 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See |
| 19 | * the GNU Lesser General Public License for more details. |
| 20 | * |
| 21 | * You should have received a copy of the GNU Lesser General Public License |
Jeff Kirsher | c057b19 | 2013-12-06 09:13:44 -0800 | [diff] [blame] | 22 | * along with this library; if not, see <http://www.gnu.org/licenses/>. |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 23 | */ |
| 24 | #include <linux/module.h> |
| 25 | #include <linux/moduleparam.h> |
| 26 | #include <linux/slab.h> |
| 27 | #include <linux/string.h> |
| 28 | #include <linux/kernel.h> |
| 29 | #include <linux/keyctl.h> |
Stephen Rothwell | af352fe | 2010-08-06 03:13:47 +0100 | [diff] [blame] | 30 | #include <linux/err.h> |
Wang Lei | 4a2d789 | 2010-08-11 09:37:58 +0100 | [diff] [blame] | 31 | #include <linux/seq_file.h> |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 32 | #include <keys/dns_resolver-type.h> |
| 33 | #include <keys/user-type.h> |
| 34 | #include "internal.h" |
| 35 | |
| 36 | MODULE_DESCRIPTION("DNS Resolver"); |
| 37 | MODULE_AUTHOR("Wang Lei"); |
| 38 | MODULE_LICENSE("GPL"); |
| 39 | |
Eric Dumazet | 95c9617 | 2012-04-15 05:58:06 +0000 | [diff] [blame] | 40 | unsigned int dns_resolver_debug; |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 41 | module_param_named(debug, dns_resolver_debug, uint, S_IWUSR | S_IRUGO); |
| 42 | MODULE_PARM_DESC(debug, "DNS Resolver debugging mask"); |
| 43 | |
| 44 | const struct cred *dns_resolver_cache; |
| 45 | |
Wang Lei | 4a2d789 | 2010-08-11 09:37:58 +0100 | [diff] [blame] | 46 | #define DNS_ERRORNO_OPTION "dnserror" |
| 47 | |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 48 | /* |
David Howells | d46d494 | 2014-07-18 18:56:36 +0100 | [diff] [blame] | 49 | * Preparse instantiation data for a dns_resolver key. |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 50 | * |
| 51 | * The data must be a NUL-terminated string, with the NUL char accounted in |
| 52 | * datalen. |
| 53 | * |
| 54 | * If the data contains a '#' characters, then we take the clause after each |
| 55 | * one to be an option of the form 'key=value'. The actual data of interest is |
| 56 | * the string leading up to the first '#'. For instance: |
| 57 | * |
| 58 | * "ip1,ip2,...#foo=bar" |
| 59 | */ |
| 60 | static int |
David Howells | d46d494 | 2014-07-18 18:56:36 +0100 | [diff] [blame] | 61 | dns_resolver_preparse(struct key_preparsed_payload *prep) |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 62 | { |
| 63 | struct user_key_payload *upayload; |
Wang Lei | 4a2d789 | 2010-08-11 09:37:58 +0100 | [diff] [blame] | 64 | unsigned long derrno; |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 65 | int ret; |
David Howells | d46d494 | 2014-07-18 18:56:36 +0100 | [diff] [blame] | 66 | int datalen = prep->datalen, result_len = 0; |
David Howells | cf7f601 | 2012-09-13 13:06:29 +0100 | [diff] [blame] | 67 | const char *data = prep->data, *end, *opt; |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 68 | |
David Howells | d46d494 | 2014-07-18 18:56:36 +0100 | [diff] [blame] | 69 | kenter("'%*.*s',%u", datalen, datalen, data, datalen); |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 70 | |
| 71 | if (datalen <= 1 || !data || data[datalen - 1] != '\0') |
| 72 | return -EINVAL; |
| 73 | datalen--; |
| 74 | |
| 75 | /* deal with any options embedded in the data */ |
Wang Lei | 4a2d789 | 2010-08-11 09:37:58 +0100 | [diff] [blame] | 76 | end = data + datalen; |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 77 | opt = memchr(data, '#', datalen); |
| 78 | if (!opt) { |
Wang Lei | 4a2d789 | 2010-08-11 09:37:58 +0100 | [diff] [blame] | 79 | /* no options: the entire data is the result */ |
| 80 | kdebug("no options"); |
| 81 | result_len = datalen; |
| 82 | } else { |
| 83 | const char *next_opt; |
| 84 | |
| 85 | result_len = opt - data; |
| 86 | opt++; |
| 87 | kdebug("options: '%s'", opt); |
| 88 | do { |
| 89 | const char *eq; |
| 90 | int opt_len, opt_nlen, opt_vlen, tmp; |
| 91 | |
| 92 | next_opt = memchr(opt, '#', end - opt) ?: end; |
| 93 | opt_len = next_opt - opt; |
| 94 | if (!opt_len) { |
| 95 | printk(KERN_WARNING |
David Howells | d46d494 | 2014-07-18 18:56:36 +0100 | [diff] [blame] | 96 | "Empty option to dns_resolver key\n"); |
Wang Lei | 4a2d789 | 2010-08-11 09:37:58 +0100 | [diff] [blame] | 97 | return -EINVAL; |
| 98 | } |
| 99 | |
| 100 | eq = memchr(opt, '=', opt_len) ?: end; |
| 101 | opt_nlen = eq - opt; |
| 102 | eq++; |
| 103 | opt_vlen = next_opt - eq; /* will be -1 if no value */ |
| 104 | |
| 105 | tmp = opt_vlen >= 0 ? opt_vlen : 0; |
| 106 | kdebug("option '%*.*s' val '%*.*s'", |
| 107 | opt_nlen, opt_nlen, opt, tmp, tmp, eq); |
| 108 | |
| 109 | /* see if it's an error number representing a DNS error |
| 110 | * that's to be recorded as the result in this key */ |
| 111 | if (opt_nlen == sizeof(DNS_ERRORNO_OPTION) - 1 && |
| 112 | memcmp(opt, DNS_ERRORNO_OPTION, opt_nlen) == 0) { |
| 113 | kdebug("dns error number option"); |
| 114 | if (opt_vlen <= 0) |
| 115 | goto bad_option_value; |
| 116 | |
“Cosmin | 92338dc | 2013-07-12 09:33:33 +0300 | [diff] [blame] | 117 | ret = kstrtoul(eq, 10, &derrno); |
Wang Lei | 4a2d789 | 2010-08-11 09:37:58 +0100 | [diff] [blame] | 118 | if (ret < 0) |
| 119 | goto bad_option_value; |
| 120 | |
| 121 | if (derrno < 1 || derrno > 511) |
| 122 | goto bad_option_value; |
| 123 | |
| 124 | kdebug("dns error no. = %lu", derrno); |
David Howells | 146aa8b | 2015-10-21 14:04:48 +0100 | [diff] [blame] | 125 | prep->payload.data[dns_key_error] = ERR_PTR(-derrno); |
Wang Lei | 4a2d789 | 2010-08-11 09:37:58 +0100 | [diff] [blame] | 126 | continue; |
| 127 | } |
| 128 | |
| 129 | bad_option_value: |
| 130 | printk(KERN_WARNING |
David Howells | d46d494 | 2014-07-18 18:56:36 +0100 | [diff] [blame] | 131 | "Option '%*.*s' to dns_resolver key:" |
Wang Lei | 4a2d789 | 2010-08-11 09:37:58 +0100 | [diff] [blame] | 132 | " bad/missing value\n", |
David Howells | d46d494 | 2014-07-18 18:56:36 +0100 | [diff] [blame] | 133 | opt_nlen, opt_nlen, opt); |
Wang Lei | 4a2d789 | 2010-08-11 09:37:58 +0100 | [diff] [blame] | 134 | return -EINVAL; |
| 135 | } while (opt = next_opt + 1, opt < end); |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 136 | } |
| 137 | |
Wang Lei | 4a2d789 | 2010-08-11 09:37:58 +0100 | [diff] [blame] | 138 | /* don't cache the result if we're caching an error saying there's no |
| 139 | * result */ |
David Howells | 146aa8b | 2015-10-21 14:04:48 +0100 | [diff] [blame] | 140 | if (prep->payload.data[dns_key_error]) { |
| 141 | kleave(" = 0 [h_error %ld]", PTR_ERR(prep->payload.data[dns_key_error])); |
Wang Lei | 4a2d789 | 2010-08-11 09:37:58 +0100 | [diff] [blame] | 142 | return 0; |
| 143 | } |
| 144 | |
| 145 | kdebug("store result"); |
David Howells | d46d494 | 2014-07-18 18:56:36 +0100 | [diff] [blame] | 146 | prep->quotalen = result_len; |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 147 | |
| 148 | upayload = kmalloc(sizeof(*upayload) + result_len + 1, GFP_KERNEL); |
| 149 | if (!upayload) { |
| 150 | kleave(" = -ENOMEM"); |
| 151 | return -ENOMEM; |
| 152 | } |
| 153 | |
| 154 | upayload->datalen = result_len; |
| 155 | memcpy(upayload->data, data, result_len); |
| 156 | upayload->data[result_len] = '\0'; |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 157 | |
David Howells | 146aa8b | 2015-10-21 14:04:48 +0100 | [diff] [blame] | 158 | prep->payload.data[dns_key_data] = upayload; |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 159 | kleave(" = 0"); |
| 160 | return 0; |
| 161 | } |
| 162 | |
| 163 | /* |
David Howells | d46d494 | 2014-07-18 18:56:36 +0100 | [diff] [blame] | 164 | * Clean up the preparse data |
| 165 | */ |
| 166 | static void dns_resolver_free_preparse(struct key_preparsed_payload *prep) |
| 167 | { |
| 168 | pr_devel("==>%s()\n", __func__); |
| 169 | |
David Howells | 146aa8b | 2015-10-21 14:04:48 +0100 | [diff] [blame] | 170 | kfree(prep->payload.data[dns_key_data]); |
David Howells | d46d494 | 2014-07-18 18:56:36 +0100 | [diff] [blame] | 171 | } |
| 172 | |
| 173 | /* |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 174 | * The description is of the form "[<type>:]<domain_name>" |
| 175 | * |
| 176 | * The domain name may be a simple name or an absolute domain name (which |
| 177 | * should end with a period). The domain name is case-independent. |
| 178 | */ |
David Howells | 0c903ab | 2014-09-16 17:36:08 +0100 | [diff] [blame] | 179 | static bool dns_resolver_cmp(const struct key *key, |
| 180 | const struct key_match_data *match_data) |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 181 | { |
| 182 | int slen, dlen, ret = 0; |
David Howells | 4629195 | 2014-09-16 17:36:02 +0100 | [diff] [blame] | 183 | const char *src = key->description, *dsp = match_data->raw_data; |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 184 | |
| 185 | kenter("%s,%s", src, dsp); |
| 186 | |
| 187 | if (!src || !dsp) |
| 188 | goto no_match; |
| 189 | |
| 190 | if (strcasecmp(src, dsp) == 0) |
| 191 | goto matched; |
| 192 | |
| 193 | slen = strlen(src); |
| 194 | dlen = strlen(dsp); |
| 195 | if (slen <= 0 || dlen <= 0) |
| 196 | goto no_match; |
| 197 | if (src[slen - 1] == '.') |
| 198 | slen--; |
| 199 | if (dsp[dlen - 1] == '.') |
| 200 | dlen--; |
| 201 | if (slen != dlen || strncasecmp(src, dsp, slen) != 0) |
| 202 | goto no_match; |
| 203 | |
| 204 | matched: |
| 205 | ret = 1; |
| 206 | no_match: |
| 207 | kleave(" = %d", ret); |
| 208 | return ret; |
| 209 | } |
| 210 | |
Wang Lei | 4a2d789 | 2010-08-11 09:37:58 +0100 | [diff] [blame] | 211 | /* |
David Howells | c06cfb0 | 2014-09-16 17:36:06 +0100 | [diff] [blame] | 212 | * Preparse the match criterion. |
| 213 | */ |
| 214 | static int dns_resolver_match_preparse(struct key_match_data *match_data) |
| 215 | { |
| 216 | match_data->lookup_type = KEYRING_SEARCH_LOOKUP_ITERATE; |
| 217 | match_data->cmp = dns_resolver_cmp; |
| 218 | return 0; |
| 219 | } |
| 220 | |
| 221 | /* |
Wang Lei | 4a2d789 | 2010-08-11 09:37:58 +0100 | [diff] [blame] | 222 | * Describe a DNS key |
| 223 | */ |
| 224 | static void dns_resolver_describe(const struct key *key, struct seq_file *m) |
| 225 | { |
Wang Lei | 4a2d789 | 2010-08-11 09:37:58 +0100 | [diff] [blame] | 226 | seq_puts(m, key->description); |
David Howells | 78b7280 | 2011-03-11 17:57:23 +0000 | [diff] [blame] | 227 | if (key_is_instantiated(key)) { |
David Howells | 146aa8b | 2015-10-21 14:04:48 +0100 | [diff] [blame] | 228 | int err = PTR_ERR(key->payload.data[dns_key_error]); |
| 229 | |
David Howells | 78b7280 | 2011-03-11 17:57:23 +0000 | [diff] [blame] | 230 | if (err) |
| 231 | seq_printf(m, ": %d", err); |
| 232 | else |
| 233 | seq_printf(m, ": %u", key->datalen); |
| 234 | } |
Wang Lei | 4a2d789 | 2010-08-11 09:37:58 +0100 | [diff] [blame] | 235 | } |
| 236 | |
David Howells | 1362fa0 | 2011-03-03 11:28:58 +0000 | [diff] [blame] | 237 | /* |
| 238 | * read the DNS data |
| 239 | * - the key's semaphore is read-locked |
| 240 | */ |
| 241 | static long dns_resolver_read(const struct key *key, |
| 242 | char __user *buffer, size_t buflen) |
| 243 | { |
David Howells | 146aa8b | 2015-10-21 14:04:48 +0100 | [diff] [blame] | 244 | int err = PTR_ERR(key->payload.data[dns_key_error]); |
| 245 | |
| 246 | if (err) |
| 247 | return err; |
David Howells | 1362fa0 | 2011-03-03 11:28:58 +0000 | [diff] [blame] | 248 | |
| 249 | return user_read(key, buffer, buflen); |
| 250 | } |
| 251 | |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 252 | struct key_type key_type_dns_resolver = { |
| 253 | .name = "dns_resolver", |
David Howells | d46d494 | 2014-07-18 18:56:36 +0100 | [diff] [blame] | 254 | .preparse = dns_resolver_preparse, |
| 255 | .free_preparse = dns_resolver_free_preparse, |
| 256 | .instantiate = generic_key_instantiate, |
David Howells | c06cfb0 | 2014-09-16 17:36:06 +0100 | [diff] [blame] | 257 | .match_preparse = dns_resolver_match_preparse, |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 258 | .revoke = user_revoke, |
| 259 | .destroy = user_destroy, |
Wang Lei | 4a2d789 | 2010-08-11 09:37:58 +0100 | [diff] [blame] | 260 | .describe = dns_resolver_describe, |
David Howells | 1362fa0 | 2011-03-03 11:28:58 +0000 | [diff] [blame] | 261 | .read = dns_resolver_read, |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 262 | }; |
| 263 | |
| 264 | static int __init init_dns_resolver(void) |
| 265 | { |
| 266 | struct cred *cred; |
| 267 | struct key *keyring; |
| 268 | int ret; |
| 269 | |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 270 | /* create an override credential set with a special thread keyring in |
| 271 | * which DNS requests are cached |
| 272 | * |
| 273 | * this is used to prevent malicious redirections from being installed |
| 274 | * with add_key(). |
| 275 | */ |
| 276 | cred = prepare_kernel_cred(NULL); |
| 277 | if (!cred) |
| 278 | return -ENOMEM; |
| 279 | |
Linus Torvalds | 2a74dbb | 2012-12-16 15:40:50 -0800 | [diff] [blame] | 280 | keyring = keyring_alloc(".dns_resolver", |
| 281 | GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred, |
David Howells | f8aa23a | 2012-10-02 19:24:56 +0100 | [diff] [blame] | 282 | (KEY_POS_ALL & ~KEY_POS_SETATTR) | |
| 283 | KEY_USR_VIEW | KEY_USR_READ, |
| 284 | KEY_ALLOC_NOT_IN_QUOTA, NULL); |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 285 | if (IS_ERR(keyring)) { |
| 286 | ret = PTR_ERR(keyring); |
| 287 | goto failed_put_cred; |
| 288 | } |
| 289 | |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 290 | ret = register_key_type(&key_type_dns_resolver); |
| 291 | if (ret < 0) |
| 292 | goto failed_put_key; |
| 293 | |
| 294 | /* instruct request_key() to use this special keyring as a cache for |
| 295 | * the results it looks up */ |
David Howells | 700920e | 2012-01-18 15:31:45 +0000 | [diff] [blame] | 296 | set_bit(KEY_FLAG_ROOT_CAN_CLEAR, &keyring->flags); |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 297 | cred->thread_keyring = keyring; |
| 298 | cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING; |
| 299 | dns_resolver_cache = cred; |
| 300 | |
| 301 | kdebug("DNS resolver keyring: %d\n", key_serial(keyring)); |
| 302 | return 0; |
| 303 | |
| 304 | failed_put_key: |
| 305 | key_put(keyring); |
| 306 | failed_put_cred: |
| 307 | put_cred(cred); |
| 308 | return ret; |
| 309 | } |
| 310 | |
| 311 | static void __exit exit_dns_resolver(void) |
| 312 | { |
| 313 | key_revoke(dns_resolver_cache->thread_keyring); |
| 314 | unregister_key_type(&key_type_dns_resolver); |
| 315 | put_cred(dns_resolver_cache); |
Wang Lei | 1a4240f | 2010-08-04 15:16:33 +0100 | [diff] [blame] | 316 | } |
| 317 | |
| 318 | module_init(init_dns_resolver) |
| 319 | module_exit(exit_dns_resolver) |
| 320 | MODULE_LICENSE("GPL"); |
David Howells | f8aa23a | 2012-10-02 19:24:56 +0100 | [diff] [blame] | 321 | |