DNS: Separate out CIFS DNS Resolver code

Separate out the DNS resolver key type from the CIFS filesystem into its own
module so that it can be made available for general use, including the AFS
filesystem module.

This facility makes it possible for the kernel to upcall to userspace to have
it issue DNS requests, package up the replies and present them to the kernel
in a useful form.  The kernel is then able to cache the DNS replies as keys
can be retained in keyrings.

Resolver keys are of type "dns_resolver" and have a case-insensitive
description that is of the form "[<type>:]<domain_name>".  The optional <type>
indicates the particular DNS lookup and packaging that's required.  The
<domain_name> is the query to be made.

If <type> isn't given, a basic hostname to IP address lookup is made, and the
result is stored in the key in the form of a printable string consisting of a
comma-separated list of IPv4 and IPv6 addresses.

This key type is supported by userspace helpers driven from /sbin/request-key
and configured through /etc/request-key.conf.  The cifs.upcall utility is
invoked for UNC path server name to IP address resolution.

The CIFS functionality is encapsulated by the dns_resolve_unc_to_ip() function,
which is used to resolve a UNC path to an IP address for CIFS filesystem.  This
part remains in the CIFS module for now.

See the added Documentation/networking/dns_resolver.txt for more information.

Signed-off-by: Wang Lei <wang840925@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>

4 files changed, 56 insertions, 205 deletions

diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
index 5739fd7f88b4..57f0aa9f141f 100644
--- a/fs/cifs/Kconfig
+++ b/fs/cifs/Kconfig
@@ -71,14 +71,14 @@ config CIFS_WEAK_PW_HASH
           If unsure, say N.
 
 config CIFS_UPCALL
-          bool "Kerberos/SPNEGO advanced session setup"
-          depends on CIFS && KEYS
-          help
-            Enables an upcall mechanism for CIFS which accesses
-            userspace helper utilities to provide SPNEGO packaged (RFC 4178)
-            Kerberos tickets which are needed to mount to certain secure servers
-            (for which more secure Kerberos authentication is required). If
-            unsure, say N.
+        bool "Kerberos/SPNEGO advanced session setup"
+        depends on CIFS && KEYS
+        select DNS_RESOLVER
+        help
+          Enables an upcall mechanism for CIFS which accesses userspace helper
+          utilities to provide SPNEGO packaged (RFC 4178) Kerberos tickets
+          which are needed to mount to certain secure servers (for which more
+          secure Kerberos authentication is required). If unsure, say N.
 
 config CIFS_XATTR
         bool "CIFS extended attributes"
@@ -122,6 +122,7 @@ config CIFS_DEBUG2
 config CIFS_DFS_UPCALL
           bool "DFS feature support"
           depends on CIFS && KEYS
+          select DNS_RESOLVER
           help
             Distributed File System (DFS) support is used to access shares
             transparently in an enterprise name space, even if the share
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 8a2cf129e535..2a0c892959f4 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -45,7 +45,6 @@
 #include "cifs_fs_sb.h"
 #include <linux/mm.h>
 #include <linux/key-type.h>
-#include "dns_resolve.h"
 #include "cifs_spnego.h"
 #include "fscache.h"
 #define CIFS_MAGIC_NUMBER 0xFF534D42    /* the first four bytes of SMB PDUs */
@@ -934,22 +933,13 @@ init_cifs(void)
         if (rc)
                 goto out_unregister_filesystem;
 #endif
-#ifdef CONFIG_CIFS_DFS_UPCALL
-        rc = cifs_init_dns_resolver();
-        if (rc)
-                goto out_unregister_key_type;
-#endif
         rc = slow_work_register_user(THIS_MODULE);
         if (rc)
-                goto out_unregister_resolver_key;
+                goto out_unregister_key_type;
 
         return 0;
 
- out_unregister_resolver_key:
-#ifdef CONFIG_CIFS_DFS_UPCALL
-        cifs_exit_dns_resolver();
  out_unregister_key_type:
-#endif
 #ifdef CONFIG_CIFS_UPCALL
         unregister_key_type(&cifs_spnego_key_type);
  out_unregister_filesystem:
@@ -976,7 +966,6 @@ exit_cifs(void)
         cifs_fscache_unregister();
 #ifdef CONFIG_CIFS_DFS_UPCALL
         cifs_dfs_release_automount_timer();
-        cifs_exit_dns_resolver();
 #endif
 #ifdef CONFIG_CIFS_UPCALL
         unregister_key_type(&cifs_spnego_key_type);
diff --git a/fs/cifs/dns_resolve.c b/fs/cifs/dns_resolve.c
index aa967e7917f8..0eb87026cad3 100644
--- a/fs/cifs/dns_resolve.c
+++ b/fs/cifs/dns_resolve.c
@@ -4,6 +4,8 @@
  *   Copyright (c) 2007 Igor Mammedov
  *   Author(s): Igor Mammedov (niallain@gmail.com)
  *              Steve French (sfrench@us.ibm.com)
+ *              Wang Lei (wang840925@gmail.com)
+ *              David Howells (dhowells@redhat.com)
  *
  *   Contains the CIFS DFS upcall routines used for hostname to
  *   IP address translation.
@@ -24,212 +26,73 @@
  */
 
 #include <linux/slab.h>
-#include <linux/keyctl.h>
-#include <linux/key-type.h>
-#include <keys/user-type.h>
+#include <linux/dns_resolver.h>
 #include "dns_resolve.h"
 #include "cifsglob.h"
 #include "cifsproto.h"
 #include "cifs_debug.h"
 
-static const struct cred *dns_resolver_cache;
-
-/* Checks if supplied name is IP address
- * returns:
- *              1 - name is IP
- *              0 - name is not IP
- */
-static int
-is_ip(const char *name, int len)
-{
-        struct sockaddr_storage ss;
-
-        return cifs_convert_address((struct sockaddr *)&ss, name, len);
-}
-
-static int
-dns_resolver_instantiate(struct key *key, const void *data,
-                size_t datalen)
-{
-        int rc = 0;
-        char *ip;
-
-        /* make sure this looks like an address */
-        if (!is_ip(data, datalen))
-                return -EINVAL;
-
-        ip = kmalloc(datalen + 1, GFP_KERNEL);
-        if (!ip)
-                return -ENOMEM;
-
-        memcpy(ip, data, datalen);
-        ip[datalen] = '\0';
-
-        key->type_data.x[0] = datalen;
-        key->payload.data = ip;
-
-        return rc;
-}
-
-static void
-dns_resolver_destroy(struct key *key)
-{
-        kfree(key->payload.data);
-}
-
-struct key_type key_type_dns_resolver = {
-        .name        = "dns_resolver",
-        .def_datalen = sizeof(struct in_addr),
-        .describe    = user_describe,
-        .instantiate = dns_resolver_instantiate,
-        .destroy     = dns_resolver_destroy,
-        .match       = user_match,
-};
-
-/* Resolves server name to ip address.
- * input:
- *      unc - server UNC
- * output:
- *      *ip_addr - pointer to server ip, caller responcible for freeing it.
- * return the length of the returned string on success
+/**
+ * dns_resolve_server_name_to_ip - Resolve UNC server name to ip address.
+ * @unc: UNC path specifying the server
+ * @ip_addr: Where to return the IP address.
+ *
+ * The IP address will be returned in string form, and the caller is
+ * responsible for freeing it.
+ *
+ * Returns length of result on success, -ve on error.
  */
 int
 dns_resolve_server_name_to_ip(const char *unc, char **ip_addr)
 {
-        const struct cred *saved_cred;
-        int rc = -EAGAIN;
-        struct key *rkey = ERR_PTR(-EAGAIN);
+        struct sockaddr_storage ss;
+        const char *hostname, *sep;
         char *name;
-        char *data = NULL;
-        int len;
+        int len, rc;
 
         if (!ip_addr || !unc)
                 return -EINVAL;
 
-        /* search for server name delimiter */
         len = strlen(unc);
         if (len < 3) {
                 cFYI(1, "%s: unc is too short: %s", __func__, unc);
                 return -EINVAL;
         }
-        len -= 2;
-        name = memchr(unc+2, '\\', len);
-        if (!name) {
-                cFYI(1, "%s: probably server name is whole unc: %s",
-                                        __func__, unc);
-        } else {
-                len = (name - unc) - 2/* leading // */;
-        }
-
-        name = kmalloc(len+1, GFP_KERNEL);
-        if (!name) {
-                rc = -ENOMEM;
-                return rc;
-        }
-        memcpy(name, unc+2, len);
-        name[len] = 0;
-
-        if (is_ip(name, len)) {
-                cFYI(1, "%s: it is IP, skipping dns upcall: %s",
-                                        __func__, name);
-                data = name;
-                goto skip_upcall;
-        }
 
-        saved_cred = override_creds(dns_resolver_cache);
-        rkey = request_key(&key_type_dns_resolver, name, "");
-        revert_creds(saved_cred);
-        if (!IS_ERR(rkey)) {
-                if (!(rkey->perm & KEY_USR_VIEW)) {
-                        down_read(&rkey->sem);
-                        rkey->perm |= KEY_USR_VIEW;
-                        up_read(&rkey->sem);
-                }
-                len = rkey->type_data.x[0];
-                data = rkey->payload.data;
-        } else {
-                cERROR(1, "%s: unable to resolve: %s", __func__, name);
-                goto out;
-        }
-
-skip_upcall:
-        if (data) {
-                *ip_addr = kmalloc(len + 1, GFP_KERNEL);
-                if (*ip_addr) {
-                        memcpy(*ip_addr, data, len + 1);
-                        if (!IS_ERR(rkey))
-                                cFYI(1, "%s: resolved: %s to %s", __func__,
-                                                        name,
-                                                        *ip_addr
-                                        );
-                        rc = len;
-                } else {
-                        rc = -ENOMEM;
-                }
-                if (!IS_ERR(rkey))
-                        key_put(rkey);
-        }
+        /* Discount leading slashes for cifs */
+        len -= 2;
+        hostname = unc + 2;
 
-out:
-        kfree(name);
+        /* Search for server name delimiter */
+        sep = memchr(hostname, '\\', len);
+        if (sep)
+                len = sep - unc;
+        else
+                cFYI(1, "%s: probably server name is whole unc: %s",
+                     __func__, unc);
+
+        /* Try to interpret hostname as an IPv4 or IPv6 address */
+        rc = cifs_convert_address((struct sockaddr *)&ss, hostname, len);
+        if (rc > 0)
+                goto name_is_IP_address;
+
+        /* Perform the upcall */
+        rc = dns_query(NULL, hostname, len, NULL, ip_addr, NULL);
+        if (rc < 0)
+                cERROR(1, "%s: unable to resolve: %*.*s",
+                       __func__, len, len, hostname);
+        else
+                cFYI(1, "%s: resolved: %*.*s to %s",
+                     __func__, len, len, hostname, *ip_addr);
         return rc;
-}
 
-int __init cifs_init_dns_resolver(void)
-{
-        struct cred *cred;
-        struct key *keyring;
-        int ret;
-
-        printk(KERN_NOTICE "Registering the %s key type\n",
-               key_type_dns_resolver.name);
-
-        /* create an override credential set with a special thread keyring in
-         * which DNS requests are cached
-         *
-         * this is used to prevent malicious redirections from being installed
-         * with add_key().
-         */
-        cred = prepare_kernel_cred(NULL);
-        if (!cred)
+name_is_IP_address:
+        name = kmalloc(len + 1, GFP_KERNEL);
+        if (!name)
                 return -ENOMEM;
-
-        keyring = key_alloc(&key_type_keyring, ".dns_resolver", 0, 0, cred,
-                            (KEY_POS_ALL & ~KEY_POS_SETATTR) |
-                            KEY_USR_VIEW | KEY_USR_READ,
-                            KEY_ALLOC_NOT_IN_QUOTA);
-        if (IS_ERR(keyring)) {
-                ret = PTR_ERR(keyring);
-                goto failed_put_cred;
-        }
-
-        ret = key_instantiate_and_link(keyring, NULL, 0, NULL, NULL);
-        if (ret < 0)
-                goto failed_put_key;
-
-        ret = register_key_type(&key_type_dns_resolver);
-        if (ret < 0)
-                goto failed_put_key;
-
-        /* instruct request_key() to use this special keyring as a cache for
-         * the results it looks up */
-        cred->thread_keyring = keyring;
-        cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
-        dns_resolver_cache = cred;
+        memcpy(name, hostname, len);
+        name[len] = 0;
+        cFYI(1, "%s: unc is IP, skipping dns upcall: %s", __func__, name);
+        *ip_addr = name;
         return 0;
-
-failed_put_key:
-        key_put(keyring);
-failed_put_cred:
-        put_cred(cred);
-        return ret;
-}
-
-void cifs_exit_dns_resolver(void)
-{
-        key_revoke(dns_resolver_cache->thread_keyring);
-        unregister_key_type(&key_type_dns_resolver);
-        put_cred(dns_resolver_cache);
-        printk(KERN_NOTICE "Unregistered %s key type\n",
-               key_type_dns_resolver.name);
 }
diff --git a/fs/cifs/dns_resolve.h b/fs/cifs/dns_resolve.h
index 5d7f291df162..d3f5d27f4d06 100644
--- a/fs/cifs/dns_resolve.h
+++ b/fs/cifs/dns_resolve.h
@@ -24,8 +24,6 @@
 #define _DNS_RESOLVE_H
 
 #ifdef __KERNEL__
-extern int __init cifs_init_dns_resolver(void);
-extern void cifs_exit_dns_resolver(void);
 extern int dns_resolve_server_name_to_ip(const char *unc, char **ip_addr);
 #endif /* KERNEL */