Manual Pages  — CAP_DNS

cap_gethostbyname, cap_gethostbyname2, cap_gethostbyaddr, cap_getnameinfo, cap_dns_type_limit, cap_dns_family_limit – library for getting network host entry in capability mode

LIBRARY SYNOPSIS DESCRIPTION LIMITS EXAMPLES SEE ALSO HISTORY AUTHORS

libcap_dns

#include <sys/nv.h>

#include <libcasper.h>

#include <casper/cap_dns.h>

struct hostent *
cap_gethostbyname(const cap_channel_t *chan, const char *name);

struct hostent *
cap_gethostbyname2(const cap_channel_t *chan, const char *name, int af);

struct hostent *
cap_gethostbyaddr(const cap_channel_t *chan, const void *addr, socklen_t len, int af);

int
cap_getnameinfo(const cap_channel_t *chan, const void *name, int namelen);

int
cap_dns_type_limit(cap_channel_t *chan, const char * const *types, size_t ntypes);

int
cap_dns_family_limit(const cap_channel_t *chan, const int *families, size_t nfamilies);

The following example first opens a capability to casper and then uses this capability to create the system.dns casper service and uses it to resolve an IP address.

cap_channel_t *capcas, *capdns;
const char *typelimit = "ADDR";
int familylimit;
const char *ipstr = "127.0.0.1";
struct in_addr ip;
struct hostent *hp;

/* Open capability to Casper. */
capcas = cap_init();
if (capcas == NULL)
        err(1, "Unable to contact Casper");

/* Enter capability mode sandbox. */
if (cap_enter() < 0 && errno != ENOSYS)
        err(1, "Unable to enter capability mode");

/* Use Casper capability to create capability to the system.dns service. */
capdns = cap_service_open(capcas, "system.dns");
if (capdns == NULL)
        err(1, "Unable to open system.dns service");

/* Close Casper capability, we don't need it anymore. */
cap_close(capcas);

/* Limit system.dns to reverse DNS lookups. */
if (cap_dns_type_limit(capdns, &typelimit, 1) < 0)
        err(1, "Unable to limit access to the system.dns service");

/* Limit system.dns to reserve IPv4 addresses */
familylimit = AF_INET;
if (cap_dns_family_limit(capdns, &familylimit, 1) < 0)
        err(1, "Unable to limit access to the system.dns service");

/* Convert IP address in C-string to in_addr. */
if (!inet_aton(ipstr, &ip))
        errx(1, "Unable to parse IP address %s.", ipstr);

/* Find hostname for the given IP address. */
hp = cap_gethostbyaddr(capdns, (const void *)&ip, sizeof(ip), AF_INET);
if (hp == NULL)
        errx(1, "No name associated with %s.", ipstr);

printf("Name associated with %s is %s. , ipstr, hp->h_name);

The cap_dns service first appeared in FreeBSD 10.3 .

The cap_dns service was implemented by Pawel Jakub Dawidek <Mt pawel@dawidek.net> under sponsorship from the FreeBSD Foundation.

This manual page was written by Mariusz Zaborski <Mt oshogbo@FreeBSD.org>.