Commit Graph

13424 Commits

Author SHA1 Message Date
Claudio Bley
6a84cd9145 Adjust legacy max payload size to account for header information
Commit 27e81517a8 set the payload size to 256 KB, which is
actually the max packet size, including the size of the header.

Reduce this by VIR_NET_MESSAGE_HEADER_MAX (24) and set
VIR_NET_MESSAGE_LEGACY_PAYLOAD_MAX to 262120, which was the original
value before increasing the limit in commit eb635de1fe.

(cherry picked from commit 609eb987c6)
2013-10-07 12:54:15 +01:00
Daniel P. Berrange
2d2b9dcee4 Fix max stream packet size for old clients
The libvirtd server pushes data out to clients. It does not
know what protocol version the client might have, so must be
conservative and use the old payload limits. ie send no more
than 256kb of data per packet.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
(cherry picked from commit 27e81517a8)
2013-10-01 13:59:12 +01:00
Daniel P. Berrange
6d1acf7195 Fix crash in remoteDispatchDomainMemoryStats (CVE-2013-4296)
The 'stats' variable was not initialized to NULL, so if some
early validation of the RPC call fails, it is possible to jump
to the 'cleanup' label and VIR_FREE an uninitialized pointer.
This is a security flaw, since the API can be called from a
readonly connection which can trigger the validation checks.

This was introduced in release v0.9.1 onwards by

  commit 158ba8730e
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Apr 13 16:21:35 2011 +0100

    Merge all returns paths from dispatcher into single path

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
(cherry picked from commit e7f400a110)

Conflicts:
	daemon/remote.c - context
2013-09-18 13:41:58 -06:00
Daniel P. Berrange
a338c40b8a Add support for using 3-arg pkcheck syntax for process (CVE-2013-4311)
With the existing pkcheck (pid, start time) tuple for identifying
the process, there is a race condition, where a process can make
a libvirt RPC call and in another thread exec a setuid application,
causing it to change to effective UID 0. This in turn causes polkit
to do its permission check based on the wrong UID.

To address this, libvirt must get the UID the caller had at time
of connect() (from SO_PEERCRED) and pass a (pid, start time, uid)
triple to the pkcheck program.

Signed-off-by: Colin Walters <walters@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
(cherry picked from commit 922b7fda77)

Conflicts:
	src/access/viraccessdriverpolkit.c

Resolution:
  Dropped file that does not exist in this branch.
2013-09-18 16:30:47 +01:00
Michal Privoznik
b5eab6a984 virFileNBDDeviceAssociate: Avoid use of uninitialized variable
The @qemunbd variable can be used uninitialized.

(cherry picked from commit 2dba0323ff)
2013-09-04 13:13:30 -06:00
Peter Krempa
c56f17e543 virbitmap: Refactor virBitmapParse to avoid access beyond bounds of array
The virBitmapParse function was calling virBitmapIsSet() function that
requires the caller to check the bounds of the bitmap without checking
them. This resulted into crashes when parsing a bitmap string that was
exceeding the bounds used as argument.

This patch refactors the function to use virBitmapSetBit without
checking if the bit is set (this function does the checks internally)
and then counts the bits in the bitmap afterwards (instead of keeping
track while parsing the string).

This patch also changes the "parse_error" label to a more common
"error".

The refactor should also get rid of the need to call sa_assert on the
returned variable as the callpath should allow coverity to infer the
possible return values.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=997367

Thanks to Alex Jia for tracking down the issue. This issue is introduced
by commit 0fc8909.

(cherry picked from commit 47b9127e88)
2013-08-20 13:58:48 +02:00
Ján Tomko
16572bc75e qemu: fix double free in qemuMigrationPrepareDirect
Remove assignment of the string freed by virURIFree
to hostname, since it's not used anywhere.

Double free introduced by ddf8ad8, useless code
introduced by f03dcc5.

https://bugzilla.redhat.com/show_bug.cgi?id=977961
(cherry picked from commit 5744d96f21)
2013-07-12 09:37:47 +02:00
Ján Tomko
1fb6ded660 storage: return -1 when fs pool can't be mounted
Don't reuse the return value of virStorageBackendFileSystemIsMounted.
If it's 0, we'd return it even if the mount command failed.

Also, don't report another error if it's -1, since one has already
been reported.

Introduced by 258e06c.

https://bugzilla.redhat.com/show_bug.cgi?id=981251
(cherry picked from commit 13fde7ceab)
2013-07-11 15:22:30 +02:00
Ján Tomko
914fedaa6b qemu: fix return value of qemuDomainBlockPivot on errors
If qemuMonitorBlockJob returned 0, qemuDomainBlockPivot
might return 0 even if an error occured.

https://bugzilla.redhat.com/show_bug.cgi?id=977678
(cherry picked from commit c34107dfd3)
2013-07-11 15:22:23 +02:00
Viktor Mihajlovski
92ea2fe0ad scsi: Fix construction of sysfs device path
The device bus value was used instead of the device target when
building the sysfs device path. Trivial.

Signed-off-by: Viktor Mihajlovski <mihajlov@linux.vnet.ibm.com>
(cherry picked from commit 2c94e00c60)
2013-07-09 07:14:55 +02:00
Dennis Chen
e898a91759 Fix vPort management: FC vHBA creation
When creating a virtual FC HBA with virsh/libvirt API, an error message
will be returned: "error: Node device not found",
also the 'nodedev-dumpxml' shows wrong information of wwpn & wwnn
for the new created device.

Signed-off-by: xschen@tnsoft.com.cn

This reverts f90af69 which switched wwpn & wwwn in the wrong place.

https://www.kernel.org/doc/Documentation/scsi/scsi_fc_transport.txt
(cherry picked from commit 3c0d5e224c)
2013-07-01 13:32:05 +02:00
Ján Tomko
b3e3bd304d bridge: don't crash on bandwidth unplug with no bandwidth
If networkUnplugBandwidth is called on a network which has
no bandwidth defined, print a warning instead of crashing.

This can happen when destroying a domain with bandwidth if
bandwidth was removed from the network after the domain was
started.

https://bugzilla.redhat.com/show_bug.cgi?id=975359
(cherry picked from commit 658c932ab4)
2013-07-01 13:31:56 +02:00
Daniel P. Berrange
67a2f4c6d8 Crash of libvirtd by unprivileged user in virConnectListAllInterfaces
On Thu, Jun 27, 2013 at 03:56:42PM +0100, Daniel P. Berrange wrote:
> Hi Security Team,
>
> I've discovered a way for an unprivileged user with a readonly connection
> to libvirtd, to crash the daemon.

Ok, the final patch for this is issue will be the simpler variant that
Eric suggested

The embargo can be considered to be lifted on Monday July 1st, at
0900 UTC

The following is the GIT change that DV or myself will apply to libvirt
GIT master immediately before the 1.1.0 release:

>From 177b4165c531a4b3ba7f6ab6aa41dca9ceb0b8cf Mon Sep 17 00:00:00 2001
From: "Daniel P. Berrange" <berrange@redhat.com>
Date: Fri, 28 Jun 2013 10:48:37 +0100
Subject: [PATCH] CVE-2013-2218: Fix crash listing network interfaces with
 filters

The virConnectListAllInterfaces method has a double-free of the
'struct netcf_if' object when any of the filtering flags cause
an interface to be skipped over. For example when running the
command 'virsh iface-list --inactive'

This is a regression introduced in release 1.0.6 by

  commit 7ac2c4fe62
  Author: Guannan Ren <gren@redhat.com>
  Date:   Tue May 21 21:29:38 2013 +0800

    interface: list all interfaces with flags == 0

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
(cherry picked from commit 244e0b8cf1)
2013-07-01 11:48:41 +01:00
Ján Tomko
38edb034c6 Fix invalid read in virCgroupGetValueStr
Don't check for '\n' at the end of file if zero bytes were read.

Found by valgrind:
==404== Invalid read of size 1
==404==    at 0x529B09F: virCgroupGetValueStr (vircgroup.c:540)
==404==    by 0x529AF64: virCgroupMoveTask (vircgroup.c:1079)
==404==    by 0x1EB475: qemuSetupCgroupForEmulator (qemu_cgroup.c:1061)
==404==    by 0x1D9489: qemuProcessStart (qemu_process.c:3801)
==404==    by 0x18557E: qemuDomainObjStart (qemu_driver.c:5787)
==404==    by 0x190FA4: qemuDomainCreateWithFlags (qemu_driver.c:5839)

Introduced by 0d0b409.

https://bugzilla.redhat.com/show_bug.cgi?id=978356
(cherry picked from commit 306c49ffd5)
2013-06-26 17:21:32 +02:00
Ján Tomko
8b9b6c2538 Plug leak in virCgroupMoveTask
We only break out of the while loop if *content is an empty string.
However the buffer has been allocated to BUFSIZ + 1 (8193 in my case),
but it gets overwritten in the next for iteration.

Move VIR_FREE right before we overwrite it to avoid the leak.

==5777== 16,386 bytes in 2 blocks are definitely lost in loss record 1,022 of 1,027
==5777==    by 0x5296E28: virReallocN (viralloc.c:184)
==5777==    by 0x52B0C66: virFileReadLimFD (virfile.c:1137)
==5777==    by 0x52B0E1A: virFileReadAll (virfile.c:1199)
==5777==    by 0x529B092: virCgroupGetValueStr (vircgroup.c:534)
==5777==    by 0x529AF64: virCgroupMoveTask (vircgroup.c:1079)

Introduced by 83e4c77.

https://bugzilla.redhat.com/show_bug.cgi?id=978352
(cherry picked from commit 5bc8ecb8d1)
2013-06-26 17:21:07 +02:00
Ján Tomko
ad62d2c70f virsh: edit: don't leak XML string on reedit or redefine
Free the old XML strings before overwriting them if the user
has chosen to reedit the file or force the redefinition.

Found by Alex Jia trying to reproduce another bug:
https://bugzilla.redhat.com/show_bug.cgi?id=977430#c3
(cherry picked from commit 1e3a252974)
2013-06-26 17:20:40 +02:00
John Ferlan
f90b024957 lxc: Resolve issue with GetScheduler APIs for non running domain
As a consequence of the cgroup layout changes from commit 'cfed9ad4', the
lxcDomainGetSchedulerParameters[Flags]()' and lxcGetSchedulerType() APIs
failed to return data for a non running domain.  This can be seen through
a 'virsh schedinfo <domain>' command which returns:

Scheduler      : Unknown
error: Requested operation is not valid: cgroup CPU controller is not mounted

Prior to that change a non running domain would return:

Scheduler      : posix
cpu_shares     : 0
vcpu_period    : 0
vcpu_quota     : 0
emulator_period: 0
emulator_quota : 0

This patch will restore the capability to return configuration only data
for a non running domain regardless of whether cgroups are available.
(cherry picked from commit 38ada092d1)
2013-06-20 10:04:24 -04:00
John Ferlan
245fc93c88 qemu: Resolve issue with GetScheduler APIs for non running domain
As a consequence of the cgroup layout changes from commit '632f78ca', the
qemuDomainGetSchedulerParameters[Flags]()' and qemuGetSchedulerType() APIs
failed to return data for a non running domain.  This can be seen through
a 'virsh schedinfo <domain>' command which returns:

Scheduler      : Unknown
error: Requested operation is not valid: cgroup CPU controller is not mounted

Prior to that change a non running domain would return:

Scheduler      : posix
cpu_shares     : 0
vcpu_period    : 0
vcpu_quota     : 0
emulator_period: 0
emulator_quota : 0

This patch will restore the capability to return configuration only data
for a non running domain regardless of whether cgroups are available.
(cherry picked from commit b237545341)
2013-06-20 10:02:33 -04:00
Ján Tomko
5cd988cb1a nodedev: fix vport detection for FC HBA
Use the host number as the host number when constructing the sysfs path
instead of the variable we are trying to fill.

https://bugzilla.redhat.com/show_bug.cgi?id=973543
(cherry picked from commit 371c15517c)
2013-06-18 15:20:23 +02:00
Jiri Denemark
945dc62f21 qemu: Avoid leaking uri in qemuMigrationPrepareDirect
(cherry picked from commit ddf8ad82eb)
2013-06-18 15:19:57 +02:00
Ján Tomko
f6ccfdeded libvirt_private.syms: add virProcessGetStartTime
https://bugzilla.redhat.com/show_bug.cgi?id=973543
(cherry picked from commit cbb3b71d3f)
2013-06-18 10:55:08 +02:00
Ján Tomko
66eca217b8 virtlockd: fix socket path
Change the socket path to match the one used by lockd driver.

https://bugzilla.redhat.com/show_bug.cgi?id=968128
(cherry picked from commit 70fe129546)
2013-06-18 10:54:53 +02:00
Jiri Denemark
9eea7e7177 spec: Explicitly require libgcrypt-devel
Our configure.ac says:

    Not all versions of gnutls include -lgcrypt, and so we add
    it explicitly for the calls to gcry_control/check_version

Thus we cannot rely on gnutls-devel to bring grcypt-devel as a
dependency.
(cherry picked from commit 3b50a711f0)
2013-06-03 10:16:13 -06:00
Jiri Denemark
87d7578254 Fix warning about using an uninitialized next_unit value
Using an uninitialized value and a bool saying if the value is valid may
confuse compilators.
(cherry picked from commit 4db39e3fee)
2013-06-03 10:15:47 -06:00
Ján Tomko
006469abdd use virBitmapFree instead of VIR_FREE for cpumask
Found by 'git grep FREE.*cpumask' after looking at 31f1f6b.
(cherry picked from commit de68895902)
2013-06-03 10:15:47 -06:00
Daniel Veillard
4497ef50dc Release of libvirt 1.0.6
* configure.ac docs/news.html.in libvirt.spec.in: update for the release
* po/*.po*: pull localization updates and regenerate the po
2013-06-03 12:09:56 +02:00
Osier Yang
622aaa0ac2 Storage: Fix the indention of rbd test file 2013-06-03 11:20:01 +08:00
Osier Yang
620c470aff nodedev_hal: Modernize the function's style
Use style like:

void
foo (const char *name)
{
    printf("Hello, %s\n", name);
}

Later patches will clean up node_device_hal.c more.
2013-06-03 11:03:56 +08:00
Osier Yang
cdb9789559 conf: Generate address for scsi host device automatically
With unknown good reasons, the attribute "bus" of scsi device
address is always set to 0, same for attribute "target". (See
virDomainDiskDefAssignAddress).

Though we might need to change the algorithm to honor "bus"
and "target" too, that's a different issue. The address generator
for scsi host device in this patch just follows the unknown
good reasons, only considering the "controller" and "unit".
It walks through all scsi controllers and their units, to see
if the address $controller:0:0:$unit can be used (if not used
by any disk or scsi host device yet), if found one, it sits on
it, otherwise, it creates a new controller (actually the controller
is implicitly created by someone else), and sits on
$new_controller:0:0:0 instead.
2013-06-01 10:00:23 +08:00
Laine Stump
2ea45647bc qemu: prevent termination of guests w/hostdev on driver reconnect
This should resolve:

  https://bugzilla.redhat.com/show_bug.cgi?id=959191

The problem was that qemuUpdateActivePciHostdevs was returning 0
(success) when no hostdevs were present, but would otherwise return -1
(failure) even when it completed successfully. It is only called from
qemuProcessReconnect(), and when qemuProcessReconnect got back an
error, it would not only stop reconnecting, but would terminate the
guest qemu process "to remove danger of it ending up running twice if
user tries to start it again later".

(This bug was introduced in commit 011cf7ad, which was pushed between
v1.0.2 and v1.0.3, so all maintenance branches from v1.0.3 up to 1.0.5
will need this one line patch applied.)
2013-05-31 14:57:55 -04:00
Guido Günther
aeef20e94b vbox: define DYNLIB_NAME for kFreeBSD
Similar to what Eric did for Cygwin it helps at least to compile
without --without-vbox
2013-05-31 19:49:13 +02:00
Eric Blake
3d2b971518 build: skip qemu in tests when !WITH_QEMU
A mingw build (where the qemu driver is not built, so WITH_QEMU
is undefined) failed with:

In file included from ../../src/qemu/qemu_command.h:30:0,
                 from ../../tests/testutilsqemu.h:4,
                 from ../../tests/networkxml2xmltest.c:14:
../../src/qemu/qemu_conf.h:53:4: error: #error "Port me"

But since testutilsqemu.c is already conditional, the header
should be likewise.

* tests/testutilsqemu.h: Make content conditional.

Signed-off-by: Eric Blake <eblake@redhat.com>
2013-05-31 11:35:34 -06:00
Daniel P. Berrange
a261996255 Introduce virFilePrintf() as a portable fprintf()
We can't use GNULIB's fprintf-posix due to licensing
incompatibilities. We do already have a portable
formatting via virAsprintf() which we got from GNULIB
though. We can use to create a virFilePrintf() function.

But really gnulib could just provide a 'fprintf'
module, that depended on just its 'asprintf' module.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-05-31 10:51:33 -06:00
Jiri Denemark
fae2505eee Document that runtime changes may be lost after S4 suspend 2013-05-31 18:03:20 +02:00
Ján Tomko
2136327e23 qemu: escape literal IPv6 address in NBD migration
A literal IPv6 must be escaped, otherwise migration fails with:
unable to execute QEMU command 'drive-mirror': address resolution failed
for f0::0d:5901: Servname not supported for ai_socktype
since QEMU treats everything after the first ':' as the port.
2013-05-31 17:21:10 +02:00
John Ferlan
64919d978e Check for existence of interface prior to setting terminate flag
https://bugzilla.redhat.com/show_bug.cgi?id=903480

During domain destruction it's possible that the learnIPAddressThread has
already removed the interface prior to the teardown filter path being run.
The teardown code would only be telling the thread to terminate.
2013-05-31 10:43:29 -04:00
John Ferlan
2f3e7f1e36 Resolve memory leak found by valgrind
Commit '6afdfc8e' adjusted the exit and error paths to go through the error
and cleanup labels, but neglected to remove the return ret prior to cleanup.
Also noted the 'type' xml string fetch was never checked for NULL which
could lead to some interesting results.
2013-05-31 10:38:15 -04:00
Peter Krempa
177046753f qemu: snapshot: Don't kill access to disk if snapshot creation fails
If snapshot creation failed for example due to invalid use of the
"REUSE_EXTERNAL" flag, libvirt killed access to the original image file
instead of the new image file. On machines with selinux this kills the
whole VM as the selinux context is enforced immediately.

* qemu_driver.c:qemuDomainSnapshotUndoSingleDiskActive():
    - Kill access to the new image file instead of the old one.

Partially resolves: https://bugzilla.redhat.com/show_bug.cgi?id=906639
2013-05-31 15:41:59 +02:00
Peter Krempa
6c23d60961 qemu: Fix damaged whitespace
After deleting "WithDriver" from the async job function the code was
unaligned.
2013-05-31 15:35:37 +02:00
Martin Kletzander
eb5fe55634 Properly indent function's opening bracket 2013-05-31 14:45:24 +02:00
Eric Blake
db23257523 build: use correct rpc.h for virtlockd
Commit d671121d was incomplete; I hit another compile fail on
cygwin not finding the correct rpc/rpc.h.

* src/Makefile.am (virtlockd_CFLAGS): Add XDR_CFLAGS.

Signed-off-by: Eric Blake <eblake@redhat.com>
2013-05-30 15:49:40 -06:00
Eric Blake
9fda950f5c build: work around cygwin header bug
A bug in Cygwin [1] and poor error messages from gcc [2] lead
to this confusing compilation error:

qemu/qemu_monitor.c:418:9: error: passing argument 2 of 'sendmsg' from incmpatible pointer type
/usr/include/sys/socket.h:42:11: note: expected 'const struct msghdr *' but argument is of type 'struct msghdr *'

[1] http://cygwin.com/ml/cygwin/2013-05/msg00451.html
[2] http://gcc.gnu.org/bugzilla/show_bug.cgi?id=57475

* src/qemu/qemu_monitor.c (includes): Include <sys/socket.h>
before <sys/un.h>.

Signed-off-by: Eric Blake <eblake@redhat.com>
2013-05-30 14:51:58 -06:00
Eric Blake
f43bb1dc20 build: cast [ug]id_t when printing
This is a recurring problem for cygwin :)
For example, see commit 23a4df88.

qemu/qemu_driver.c: In function 'qemuStateInitialize':
qemu/qemu_driver.c:691:13: error: format '%d' expects type 'int', but argument 8 has type 'uid_t' [-Wformat]

* src/qemu/qemu_driver.c (qemuStateInitialize): Add casts.
* daemon/remote.c (remoteDispatchAuthList): Likewise.

Signed-off-by: Eric Blake <eblake@redhat.com>
2013-05-30 10:36:16 -06:00
Eric Blake
19a7f9fffb build: port qemu to cygwin
A cygwin build of the qemu driver fails with:

qemu/qemu_process.c: In function 'qemuPrepareCpumap':
qemu/qemu_process.c:1803:31: error: 'CPU_SETSIZE' undeclared (first use in this function)

CPU_SETSIZE is a Linux extension in <sched.h>; a bit more portable
is using sysconf if _SC_NPROCESSORS_CONF is defined (several platforms
have it, including Cygwin).  Ultimately, I would have preferred to
use gnulib's 'nproc' module, but it is currently under an incompatible
license.

* src/qemu/qemu_conf.h (QEMUD_CPUMASK_LEN): Provide definition on
cygwin.

Signed-off-by: Eric Blake <eblake@redhat.com>
2013-05-30 06:39:27 -06:00
Eric Blake
d671121ddc build: use correct rpc.h for lockd
On cygwin, the build failed with:

In file included from ./rpc/virnetmessage.h:24:0,
                 from ./rpc/virnetclient.h:29,
                 from locking/lock_driver_lockd.c:31:
./rpc/virnetprotocol.h:9:21: fatal error: rpc/rpc.h: No such file or directory

* src/Makefile.am (lockd_la_CFLAGS): Add XDR_CFLAGS.

Signed-off-by: Eric Blake <eblake@redhat.com>
2013-05-29 19:52:58 -06:00
Eric Blake
1be3dfdfa7 build: work around broken sasl header
Compilation on cygwin failed due to a bug in the sasl headers
present on that platform (libsasl2-devel 2.1.26):

In file included from rpc/virnetserverclient.c:27:0:
/usr/include/sasl/sasl.h:230:38: error: expected declaration specifiers or '...' before 'size_t'

Upstream is aware of their bug:
https://bugzilla.cyrusimap.org/show_bug.cgi?id=3759

* src/rpc/virnetserverclient.c (includes): Ensure size_t is
defined before using sasl.h.

Signed-off-by: Eric Blake <eblake@redhat.com>
2013-05-29 14:07:53 -06:00
Eric Blake
1cd97c7ab4 build: fix typo in earlier commit
Bummer, I committed, then fixed a typo, then tested, and forgot to
amend the commit before pushing 7d21d6b6.

* src/rpc/virnettlscontext.c (includes): Use correct spelling.
2013-05-29 11:08:14 -06:00
Cole Robinson
5e1de4fcdd virsh: migrate: Don't disallow --p2p and --migrateuri
Because it's a valid combination. p2p still uses a separate channel
for qemu migration, so there's value in letting the user specify a manual
migrate URI for overriding auto-port, or libvirt's FQDN lookup.

What _isn't_ allowed is --migrateuri and TUNNELLED, since there is
no separate migration channel. Disallow that instead
2013-05-29 12:31:00 -04:00
Cole Robinson
98bbda00cf qemu: migration: error if tunnelled + storage specified
Since as the code indicates it doesn't work yet, so let's be
explicit about it.
2013-05-29 12:31:00 -04:00
Cole Robinson
5751fc4f4e qemu: migration: Improve p2p error if we can't open conn
By actually showing the Open() error to the user
2013-05-29 12:31:00 -04:00