DNS: Separate out CIFS DNS Resolver code

			     ===================

			     DNS Resolver Module

			     ===================

Contents:

 - Overview.

 - Compilation.

 - Setting up.

 - Usage.

 - Mechanism.

 - Debugging.

========

OVERVIEW

========

The DNS resolver module provides a way for kernel services to make DNS queries

by way of requesting a key of key type dns_resolver.  These queries are

upcalled to userspace through /sbin/request-key.

These routines must be supported by userspace tools dns.upcall, cifs.upcall and

request-key.  It is under development and does not yet provide the full feature

set.  The features it does support include:

 (*) Implements the dns_resolver key_type to contact userspace.

It does not yet support the following AFS features:

 (*) Dns query support for AFSDB resource record.

This code is extracted from the CIFS filesystem.

===========

COMPILATION

===========

The module should be enabled by turning on the kernel configuration options:

	CONFIG_DNS_RESOLVER	- tristate "DNS Resolver support"

==========

SETTING UP

==========

To set up this facility, the /etc/request-key.conf file must be altered so that

/sbin/request-key can appropriately direct the upcalls.  For example, to handle

basic dname to IPv4/IPv6 address resolution, the following line should be

added:

	#OP	TYPE		DESC	CO-INFO	PROGRAM ARG1 ARG2 ARG3 ...

	#======	============	=======	=======	==========================

	create	dns_resolver  	*	*	/usr/sbin/cifs.upcall %k

To direct a query for query type 'foo', a line of the following should be added

before the more general line given above as the first match is the one taken.

	create	dns_resolver  	foo:*	*	/usr/sbin/dns.foo %k

=====

USAGE

=====

To make use of this facility, one of the following functions that are

implemented in the module can be called after doing:

	#include <linux/dns_resolver.h>

 (1) int dns_query(const char *type, const char *name, size_t namelen,

		   const char *options, char **_result, time_t *_expiry);

     This is the basic access function.  It looks for a cached DNS query and if

     it doesn't find it, it upcalls to userspace to make a new DNS query, which

     may then be cached.  The key description is constructed as a string of the

     form:

		[<type>:]<name>

     where <type> optionally specifies the particular upcall program to invoke,

     and thus the type of query to do, and <name> specifies the string to be

     looked up.  The default query type is a straight hostname to IP address

     set lookup.

     The name parameter is not required to be a NUL-terminated string, and its

     length should be given by the namelen argument.

     The options parameter may be NULL or it may be a set of options

     appropriate to the query type.

     The return value is a string appropriate to the query type.  For instance,

     for the default query type it is just a list of comma-separated IPv4 and

     IPv6 addresses.  The caller must free the result.

     The length of the result string is returned on success, and a -ve error

     code is returned otherwise.  -EKEYREJECTED will be returned if the DNS

     lookup failed.

     If _expiry is non-NULL, the expiry time (TTL) of the result will be

     returned also.

=========

MECHANISM

=========

The dnsresolver module registers a key type called "dns_resolver".  Keys of

this type are used to transport and cache DNS lookup results from userspace.

When dns_query() is invoked, it calls request_key() to search the local

keyrings for a cached DNS result.  If that fails to find one, it upcalls to

userspace to get a new result.

Upcalls to userspace are made through the request_key() upcall vector, and are

directed by means of configuration lines in /etc/request-key.conf that tell

/sbin/request-key what program to run to instantiate the key.

The upcall handler program is responsible for querying the DNS, processing the

result into a form suitable for passing to the keyctl_instantiate_key()

routine.  This then passes the data to dns_resolver_instantiate() which strips

off and processes any options included in the data, and then attaches the

remainder of the string to the key as its payload.

The upcall handler program should set the expiry time on the key to that of the

lowest TTL of all the records it has extracted a result from.  This means that

the key will be discarded and recreated when the data it holds has expired.

dns_query() returns a copy of the value attached to the key, or an error if

that is indicated instead.

See <file:Documentation/keys-request-key.txt> for further information about

request-key function.

=========

DEBUGGING

=========

Debugging messages can be turned on dynamically by writing a 1 into the

following file:

        /sys/module/dnsresolver/parameters/debug

config CIFS_UPCALL

	bool "Kerberos/SPNEGO advanced session setup"

	depends on CIFS && KEYS

	select DNS_RESOLVER

	help

	    Enables an upcall mechanism for CIFS which accesses

	    userspace helper utilities to provide SPNEGO packaged (RFC 4178)

	    Kerberos tickets which are needed to mount to certain secure servers

	    (for which more secure Kerberos authentication is required). If

	    unsure, say N.

	  Enables an upcall mechanism for CIFS which accesses userspace helper

	  utilities to provide SPNEGO packaged (RFC 4178) Kerberos tickets

	  which are needed to mount to certain secure servers (for which more

	  secure Kerberos authentication is required). If unsure, say N.

config CIFS_XATTR

        bool "CIFS extended attributes"

config CIFS_DFS_UPCALL

	  bool "DFS feature support"

	  depends on CIFS && KEYS

	  select DNS_RESOLVER

	  help

	    Distributed File System (DFS) support is used to access shares

	    transparently in an enterprise name space, even if the share

#include "cifs_fs_sb.h"

#include <linux/mm.h>

#include <linux/key-type.h>

#include "dns_resolve.h"

#include "cifs_spnego.h"

#include "fscache.h"

#define CIFS_MAGIC_NUMBER 0xFF534D42	/* the first four bytes of SMB PDUs */

	rc = register_key_type(&cifs_spnego_key_type);

	if (rc)

		goto out_unregister_filesystem;

#endif

#ifdef CONFIG_CIFS_DFS_UPCALL

	rc = cifs_init_dns_resolver();

	if (rc)

		goto out_unregister_key_type;

#endif

	rc = slow_work_register_user(THIS_MODULE);

	if (rc)

		goto out_unregister_resolver_key;

		goto out_unregister_key_type;

	return 0;

 out_unregister_resolver_key:

#ifdef CONFIG_CIFS_DFS_UPCALL

	cifs_exit_dns_resolver();

 out_unregister_key_type:

#endif

#ifdef CONFIG_CIFS_UPCALL

	unregister_key_type(&cifs_spnego_key_type);

 out_unregister_filesystem:

	cifs_fscache_unregister();

#ifdef CONFIG_CIFS_DFS_UPCALL

	cifs_dfs_release_automount_timer();

	cifs_exit_dns_resolver();

#endif

#ifdef CONFIG_CIFS_UPCALL

	unregister_key_type(&cifs_spnego_key_type);

 *   Copyright (c) 2007 Igor Mammedov

 *   Author(s): Igor Mammedov (niallain@gmail.com)

 *              Steve French (sfrench@us.ibm.com)

 *              Wang Lei (wang840925@gmail.com)

 *		David Howells (dhowells@redhat.com)

 *

 *   Contains the CIFS DFS upcall routines used for hostname to

 *   IP address translation.

 */

#include <linux/slab.h>

#include <linux/keyctl.h>

#include <linux/key-type.h>

#include <keys/user-type.h>

#include <linux/dns_resolver.h>

#include "dns_resolve.h"

#include "cifsglob.h"

#include "cifsproto.h"

#include "cifs_debug.h"

static const struct cred *dns_resolver_cache;

/* Checks if supplied name is IP address

 * returns:

 * 		1 - name is IP

 * 		0 - name is not IP

 */

static int

is_ip(const char *name, int len)

{

	struct sockaddr_storage ss;

	return cifs_convert_address((struct sockaddr *)&ss, name, len);

}

static int

dns_resolver_instantiate(struct key *key, const void *data,

		size_t datalen)

{

	int rc = 0;

	char *ip;

	/* make sure this looks like an address */

	if (!is_ip(data, datalen))

		return -EINVAL;

	ip = kmalloc(datalen + 1, GFP_KERNEL);

	if (!ip)

		return -ENOMEM;

	memcpy(ip, data, datalen);

	ip[datalen] = '\0';

	key->type_data.x[0] = datalen;

	key->payload.data = ip;

	return rc;

}

static void

dns_resolver_destroy(struct key *key)

{

	kfree(key->payload.data);

}

struct key_type key_type_dns_resolver = {

	.name        = "dns_resolver",

	.def_datalen = sizeof(struct in_addr),

	.describe    = user_describe,

	.instantiate = dns_resolver_instantiate,

	.destroy     = dns_resolver_destroy,

	.match       = user_match,

};

/* Resolves server name to ip address.

 * input:

 * 	unc - server UNC

 * output:

 * 	*ip_addr - pointer to server ip, caller responcible for freeing it.

 * return the length of the returned string on success

/**

 * dns_resolve_server_name_to_ip - Resolve UNC server name to ip address.

 * @unc: UNC path specifying the server

 * @ip_addr: Where to return the IP address.

 *

 * The IP address will be returned in string form, and the caller is

 * responsible for freeing it.

 *

 * Returns length of result on success, -ve on error.

 */

int

dns_resolve_server_name_to_ip(const char *unc, char **ip_addr)

{

	const struct cred *saved_cred;

	int rc = -EAGAIN;

	struct key *rkey = ERR_PTR(-EAGAIN);

	struct sockaddr_storage ss;

	const char *hostname, *sep;

	char *name;

	char *data = NULL;

	int len;

	int len, rc;

	if (!ip_addr || !unc)

		return -EINVAL;

	/* search for server name delimiter */

	len = strlen(unc);

	if (len < 3) {

		cFYI(1, "%s: unc is too short: %s", __func__, unc);

		return -EINVAL;

	}

	/* Discount leading slashes for cifs */

	len -= 2;

	name = memchr(unc+2, '\\', len);

	if (!name) {

	hostname = unc + 2;

	/* Search for server name delimiter */

	sep = memchr(hostname, '\\', len);

	if (sep)

		len = sep - unc;

	else

		cFYI(1, "%s: probably server name is whole unc: %s",

		     __func__, unc);

	} else {

		len = (name - unc) - 2/* leading // */;

	}

	name = kmalloc(len+1, GFP_KERNEL);

	if (!name) {

		rc = -ENOMEM;

		return rc;

	}

	memcpy(name, unc+2, len);

	name[len] = 0;

	if (is_ip(name, len)) {

		cFYI(1, "%s: it is IP, skipping dns upcall: %s",

					__func__, name);

		data = name;

		goto skip_upcall;

	}

	saved_cred = override_creds(dns_resolver_cache);

	rkey = request_key(&key_type_dns_resolver, name, "");

	revert_creds(saved_cred);

	if (!IS_ERR(rkey)) {

		if (!(rkey->perm & KEY_USR_VIEW)) {

			down_read(&rkey->sem);

			rkey->perm |= KEY_USR_VIEW;

			up_read(&rkey->sem);

		}

		len = rkey->type_data.x[0];

		data = rkey->payload.data;

	} else {

		cERROR(1, "%s: unable to resolve: %s", __func__, name);

		goto out;

	}

skip_upcall:

	if (data) {

		*ip_addr = kmalloc(len + 1, GFP_KERNEL);

		if (*ip_addr) {

			memcpy(*ip_addr, data, len + 1);

			if (!IS_ERR(rkey))

				cFYI(1, "%s: resolved: %s to %s", __func__,

							name,

							*ip_addr

					);

			rc = len;

		} else {

			rc = -ENOMEM;

		}

		if (!IS_ERR(rkey))

			key_put(rkey);

	}

out:

	kfree(name);

	/* Try to interpret hostname as an IPv4 or IPv6 address */

	rc = cifs_convert_address((struct sockaddr *)&ss, hostname, len);

	if (rc > 0)

		goto name_is_IP_address;

	/* Perform the upcall */

	rc = dns_query(NULL, hostname, len, NULL, ip_addr, NULL);

	if (rc < 0)

		cERROR(1, "%s: unable to resolve: %*.*s",

		       __func__, len, len, hostname);

	else

		cFYI(1, "%s: resolved: %*.*s to %s",

		     __func__, len, len, hostname, *ip_addr);

	return rc;

}

int __init cifs_init_dns_resolver(void)

{

	struct cred *cred;

	struct key *keyring;

	int ret;

	printk(KERN_NOTICE "Registering the %s key type\n",

	       key_type_dns_resolver.name);

	/* create an override credential set with a special thread keyring in

	 * which DNS requests are cached

	 *

	 * this is used to prevent malicious redirections from being installed

	 * with add_key().

	 */

	cred = prepare_kernel_cred(NULL);

	if (!cred)

name_is_IP_address:

	name = kmalloc(len + 1, GFP_KERNEL);

	if (!name)

		return -ENOMEM;

	keyring = key_alloc(&key_type_keyring, ".dns_resolver", 0, 0, cred,

			    (KEY_POS_ALL & ~KEY_POS_SETATTR) |

			    KEY_USR_VIEW | KEY_USR_READ,

			    KEY_ALLOC_NOT_IN_QUOTA);

	if (IS_ERR(keyring)) {

		ret = PTR_ERR(keyring);

		goto failed_put_cred;

	}

	ret = key_instantiate_and_link(keyring, NULL, 0, NULL, NULL);

	if (ret < 0)

		goto failed_put_key;

	ret = register_key_type(&key_type_dns_resolver);

	if (ret < 0)

		goto failed_put_key;

	/* instruct request_key() to use this special keyring as a cache for

	 * the results it looks up */

	cred->thread_keyring = keyring;

	cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;

	dns_resolver_cache = cred;

	memcpy(name, hostname, len);

	name[len] = 0;

	cFYI(1, "%s: unc is IP, skipping dns upcall: %s", __func__, name);

	*ip_addr = name;

	return 0;

failed_put_key:

	key_put(keyring);

failed_put_cred:

	put_cred(cred);

	return ret;

}

void cifs_exit_dns_resolver(void)

{

	key_revoke(dns_resolver_cache->thread_keyring);

	unregister_key_type(&key_type_dns_resolver);

	put_cred(dns_resolver_cache);

	printk(KERN_NOTICE "Unregistered %s key type\n",

	       key_type_dns_resolver.name);

}

#define _DNS_RESOLVE_H

#ifdef __KERNEL__

extern int __init cifs_init_dns_resolver(void);

extern void cifs_exit_dns_resolver(void);

extern int dns_resolve_server_name_to_ip(const char *unc, char **ip_addr);

#endif /* KERNEL */