^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) /* Upcall routine, designed to work as a key type and working through
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) * /sbin/request-key to contact userspace when handling DNS queries.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) * See Documentation/networking/dns_resolver.rst
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * Copyright (c) 2007 Igor Mammedov
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) * Author(s): Igor Mammedov (niallain@gmail.com)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) * Steve French (sfrench@us.ibm.com)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) * Wang Lei (wang840925@gmail.com)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) * David Howells (dhowells@redhat.com)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) * The upcall wrapper used to make an arbitrary DNS query.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) * This function requires the appropriate userspace tool dns.upcall to be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) * installed and something like the following lines should be added to the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) * /etc/request-key.conf file:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) * create dns_resolver * * /sbin/dns.upcall %k
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) * For example to use this module to query AFSDB RR:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) * create dns_resolver afsdb:* * /sbin/dns.afsdb %k
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) * This library is free software; you can redistribute it and/or modify
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) * it under the terms of the GNU Lesser General Public License as published
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) * by the Free Software Foundation; either version 2.1 of the License, or
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) * (at your option) any later version.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) * This library is distributed in the hope that it will be useful,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) * but WITHOUT ANY WARRANTY; without even the implied warranty of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) * the GNU Lesser General Public License for more details.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) * You should have received a copy of the GNU Lesser General Public License
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) * along with this library; if not, see <http://www.gnu.org/licenses/>.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) #include <linux/module.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) #include <linux/slab.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) #include <linux/cred.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) #include <linux/dns_resolver.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) #include <linux/err.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) #include <net/net_namespace.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) #include <keys/dns_resolver-type.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) #include <keys/user-type.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) #include "internal.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) * dns_query - Query the DNS
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) * @net: The network namespace to operate in.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) * @type: Query type (or NULL for straight host->IP lookup)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) * @name: Name to look up
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) * @namelen: Length of name
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) * @options: Request options (or NULL if no options)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) * @_result: Where to place the returned data (or NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) * @_expiry: Where to store the result expiry time (or NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) * @invalidate: Always invalidate the key after use
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) * The data will be returned in the pointer at *result, if provided, and the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) * caller is responsible for freeing it.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) * The description should be of the form "[<query_type>:]<domain_name>", and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) * the options need to be appropriate for the query type requested. If no
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) * query_type is given, then the query is a straight hostname to IP address
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) * lookup.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) * The DNS resolution lookup is performed by upcalling to userspace by way of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) * requesting a key of type dns_resolver.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) * Returns the size of the result on success, -ve error code otherwise.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) int dns_query(struct net *net,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) const char *type, const char *name, size_t namelen,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) const char *options, char **_result, time64_t *_expiry,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) bool invalidate)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) struct key *rkey;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) struct user_key_payload *upayload;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) const struct cred *saved_cred;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) size_t typelen, desclen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) char *desc, *cp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) int ret, len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) kenter("%s,%*.*s,%zu,%s",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) type, (int)namelen, (int)namelen, name, namelen, options);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) if (!name || namelen == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) /* construct the query key description as "[<type>:]<name>" */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) typelen = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) desclen = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) if (type) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) typelen = strlen(type);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) if (typelen < 1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) desclen += typelen + 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) if (namelen < 3 || namelen > 255)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) desclen += namelen + 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) desc = kmalloc(desclen, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) if (!desc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) cp = desc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) if (type) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) memcpy(cp, type, typelen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) cp += typelen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) *cp++ = ':';
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) memcpy(cp, name, namelen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) cp += namelen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) *cp = '\0';
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) if (!options)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) options = "";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) kdebug("call request_key(,%s,%s)", desc, options);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) /* make the upcall, using special credentials to prevent the use of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) * add_key() to preinstall malicious redirections
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) saved_cred = override_creds(dns_resolver_cache);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) rkey = request_key_net(&key_type_dns_resolver, desc, net, options);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) revert_creds(saved_cred);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) kfree(desc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) if (IS_ERR(rkey)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) ret = PTR_ERR(rkey);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) down_read(&rkey->sem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) set_bit(KEY_FLAG_ROOT_CAN_INVAL, &rkey->flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) rkey->perm |= KEY_USR_VIEW;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) ret = key_validate(rkey);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) if (ret < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) goto put;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) /* If the DNS server gave an error, return that to the caller */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) ret = PTR_ERR(rkey->payload.data[dns_key_error]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) goto put;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) upayload = user_key_payload_locked(rkey);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) len = upayload->datalen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) if (_result) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) ret = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) *_result = kmemdup_nul(upayload->data, len, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) if (!*_result)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) goto put;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) if (_expiry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) *_expiry = rkey->expiry;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) ret = len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) put:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) up_read(&rkey->sem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) if (invalidate)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) key_invalidate(rkey);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) key_put(rkey);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) kleave(" = %d", ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) EXPORT_SYMBOL(dns_query);
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags