1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25#include <linux/module.h>
26#include <linux/moduleparam.h>
27#include <linux/slab.h>
28#include <linux/string.h>
29#include <linux/kernel.h>
30#include <linux/keyctl.h>
31#include <linux/err.h>
32#include <linux/seq_file.h>
33#include <keys/dns_resolver-type.h>
34#include <keys/user-type.h>
35#include "internal.h"
36
37MODULE_DESCRIPTION("DNS Resolver");
38MODULE_AUTHOR("Wang Lei");
39MODULE_LICENSE("GPL");
40
41unsigned int dns_resolver_debug;
42module_param_named(debug, dns_resolver_debug, uint, S_IWUSR | S_IRUGO);
43MODULE_PARM_DESC(debug, "DNS Resolver debugging mask");
44
45const struct cred *dns_resolver_cache;
46
47#define DNS_ERRORNO_OPTION "dnserror"
48
49
50
51
52
53
54
55
56
57
58
59
60
61static int
62dns_resolver_instantiate(struct key *key, struct key_preparsed_payload *prep)
63{
64 struct user_key_payload *upayload;
65 unsigned long derrno;
66 int ret;
67 size_t datalen = prep->datalen, result_len = 0;
68 const char *data = prep->data, *end, *opt;
69
70 kenter("%%%d,%s,'%*.*s',%zu",
71 key->serial, key->description,
72 (int)datalen, (int)datalen, data, datalen);
73
74 if (datalen <= 1 || !data || data[datalen - 1] != '\0')
75 return -EINVAL;
76 datalen--;
77
78
79 end = data + datalen;
80 opt = memchr(data, '#', datalen);
81 if (!opt) {
82
83 kdebug("no options");
84 result_len = datalen;
85 } else {
86 const char *next_opt;
87
88 result_len = opt - data;
89 opt++;
90 kdebug("options: '%s'", opt);
91 do {
92 const char *eq;
93 int opt_len, opt_nlen, opt_vlen, tmp;
94
95 next_opt = memchr(opt, '#', end - opt) ?: end;
96 opt_len = next_opt - opt;
97 if (!opt_len) {
98 printk(KERN_WARNING
99 "Empty option to dns_resolver key %d\n",
100 key->serial);
101 return -EINVAL;
102 }
103
104 eq = memchr(opt, '=', opt_len) ?: end;
105 opt_nlen = eq - opt;
106 eq++;
107 opt_vlen = next_opt - eq;
108
109 tmp = opt_vlen >= 0 ? opt_vlen : 0;
110 kdebug("option '%*.*s' val '%*.*s'",
111 opt_nlen, opt_nlen, opt, tmp, tmp, eq);
112
113
114
115 if (opt_nlen == sizeof(DNS_ERRORNO_OPTION) - 1 &&
116 memcmp(opt, DNS_ERRORNO_OPTION, opt_nlen) == 0) {
117 kdebug("dns error number option");
118 if (opt_vlen <= 0)
119 goto bad_option_value;
120
121 ret = kstrtoul(eq, 10, &derrno);
122 if (ret < 0)
123 goto bad_option_value;
124
125 if (derrno < 1 || derrno > 511)
126 goto bad_option_value;
127
128 kdebug("dns error no. = %lu", derrno);
129 key->type_data.x[0] = -derrno;
130 continue;
131 }
132
133 bad_option_value:
134 printk(KERN_WARNING
135 "Option '%*.*s' to dns_resolver key %d:"
136 " bad/missing value\n",
137 opt_nlen, opt_nlen, opt, key->serial);
138 return -EINVAL;
139 } while (opt = next_opt + 1, opt < end);
140 }
141
142
143
144 if (key->type_data.x[0]) {
145 kleave(" = 0 [h_error %ld]", key->type_data.x[0]);
146 return 0;
147 }
148
149 kdebug("store result");
150 ret = key_payload_reserve(key, result_len);
151 if (ret < 0)
152 return -EINVAL;
153
154 upayload = kmalloc(sizeof(*upayload) + result_len + 1, GFP_KERNEL);
155 if (!upayload) {
156 kleave(" = -ENOMEM");
157 return -ENOMEM;
158 }
159
160 upayload->datalen = result_len;
161 memcpy(upayload->data, data, result_len);
162 upayload->data[result_len] = '\0';
163 rcu_assign_pointer(key->payload.data, upayload);
164
165 kleave(" = 0");
166 return 0;
167}
168
169
170
171
172
173
174
175static int
176dns_resolver_match(const struct key *key, const void *description)
177{
178 int slen, dlen, ret = 0;
179 const char *src = key->description, *dsp = description;
180
181 kenter("%s,%s", src, dsp);
182
183 if (!src || !dsp)
184 goto no_match;
185
186 if (strcasecmp(src, dsp) == 0)
187 goto matched;
188
189 slen = strlen(src);
190 dlen = strlen(dsp);
191 if (slen <= 0 || dlen <= 0)
192 goto no_match;
193 if (src[slen - 1] == '.')
194 slen--;
195 if (dsp[dlen - 1] == '.')
196 dlen--;
197 if (slen != dlen || strncasecmp(src, dsp, slen) != 0)
198 goto no_match;
199
200matched:
201 ret = 1;
202no_match:
203 kleave(" = %d", ret);
204 return ret;
205}
206
207
208
209
210static void dns_resolver_describe(const struct key *key, struct seq_file *m)
211{
212 int err = key->type_data.x[0];
213
214 seq_puts(m, key->description);
215 if (key_is_instantiated(key)) {
216 if (err)
217 seq_printf(m, ": %d", err);
218 else
219 seq_printf(m, ": %u", key->datalen);
220 }
221}
222
223
224
225
226
227static long dns_resolver_read(const struct key *key,
228 char __user *buffer, size_t buflen)
229{
230 if (key->type_data.x[0])
231 return key->type_data.x[0];
232
233 return user_read(key, buffer, buflen);
234}
235
236struct key_type key_type_dns_resolver = {
237 .name = "dns_resolver",
238 .instantiate = dns_resolver_instantiate,
239 .match = dns_resolver_match,
240 .revoke = user_revoke,
241 .destroy = user_destroy,
242 .describe = dns_resolver_describe,
243 .read = dns_resolver_read,
244};
245
246static int __init init_dns_resolver(void)
247{
248 struct cred *cred;
249 struct key *keyring;
250 int ret;
251
252
253
254
255
256
257
258 cred = prepare_kernel_cred(NULL);
259 if (!cred)
260 return -ENOMEM;
261
262 keyring = keyring_alloc(".dns_resolver",
263 GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred,
264 (KEY_POS_ALL & ~KEY_POS_SETATTR) |
265 KEY_USR_VIEW | KEY_USR_READ,
266 KEY_ALLOC_NOT_IN_QUOTA, NULL);
267 if (IS_ERR(keyring)) {
268 ret = PTR_ERR(keyring);
269 goto failed_put_cred;
270 }
271
272 ret = register_key_type(&key_type_dns_resolver);
273 if (ret < 0)
274 goto failed_put_key;
275
276
277
278 set_bit(KEY_FLAG_ROOT_CAN_CLEAR, &keyring->flags);
279 cred->thread_keyring = keyring;
280 cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
281 dns_resolver_cache = cred;
282
283 kdebug("DNS resolver keyring: %d\n", key_serial(keyring));
284 return 0;
285
286failed_put_key:
287 key_put(keyring);
288failed_put_cred:
289 put_cred(cred);
290 return ret;
291}
292
293static void __exit exit_dns_resolver(void)
294{
295 key_revoke(dns_resolver_cache->thread_keyring);
296 unregister_key_type(&key_type_dns_resolver);
297 put_cred(dns_resolver_cache);
298}
299
300module_init(init_dns_resolver)
301module_exit(exit_dns_resolver)
302MODULE_LICENSE("GPL");
303
304