External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-28 08:35:22 +00:00
Code Issues Packages Projects Releases Wiki Activity
Libvirt provides a portable, long term stable C API for managing the virtualization technologies provided by many operating systems. It includes support for QEMU, KVM, Xen, LXC, bhyve, Virtuozzo, VMware vCenter and ESX, VMware Desktop, Hyper-V, VirtualBox and the POWER Hypervisor.
11,083 Commits 67 Branches 629 Tags 866 MiB
C 94.8%
Python 2%
Meson 0.9%
Shell 0.8%
Dockerfile 0.6%
Other 0.8%
84cbd3a98a
Go to file
Laine Stump 84cbd3a98a network: prevent dnsmasq from listening on localhost 
This patch resolves the problem reported in:

   https://bugzilla.redhat.com/show_bug.cgi?id=886663

The source of the problem was the fix for CVE 2011-3411:

   https://bugzilla.redhat.com/show_bug.cgi?id=833033

which was originally committed upstream in commit
753ff83a50. That commit improperly
removed the "--except-interface lo" from dnsmasq commandlines when
--bind-dynamic was used (based on comments in the latter bug).

It turns out that the problem reported in the CVE could be eliminated
without removing "--except-interface lo", and removing it actually
caused each instance of dnsmasq to listen on localhost on port 53,
which created a new problem:

If another instance of dnsmasq using "bind-interfaces" (instead of
"bind-dynamic") had already been started (or if another instance
started later used "bind-dynamic"), this wouldn't have any immediately
visible ill effects, but if you tried to start another dnsmasq
instance using "bind-interfaces" *after* starting any libvirt
networks, the new dnsmasq would fail to start, because there was
already another process listening on port 53.

This patch changes the network driver to *always* add
"except-interface=lo" to dnsmasq conf files, regardless of whether we use
bind-dynamic or bind-interfaces. This way no libvirt dnsmasq instances
are listening on localhost (and the CVE is still fixed).

The actual code change is miniscule, but must be propogated through all
of the test files as well.

(This is *not* a cherry-pick of the upstream commit that fixes the bug
(commit d66eb78667), because subsequent
to the CVE fix, another patch changed the network driver to put
dnsmasq options in a conf file rather than directly on the dnsmasq
commandline preserving the same options), so a cherry-pick is just one
very large conflict.)
2012-12-13 12:29:53 -05:00
.gnulib@b4938324b7 build: avoid infinite autogen loop 2012-10-27 15:06:31 -04:00
build-aux maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
daemon daemon: Avoid 'Could not find keytab file' in syslog 2012-10-27 15:11:09 -04:00
docs documentation: HTML tag fix 2012-10-27 15:16:41 -04:00
examples maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
gnulib build: fix fresh checkout on RHEL5 2012-04-19 17:11:43 -06:00
include maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
m4 build: avoid -Wno-format on new-enough gcc 2012-10-18 13:11:29 -04:00
po Prep for release 0.10.2.2 2012-12-09 18:21:26 -05:00
python Properly parse (unsigned) long long 2012-10-18 13:19:51 -04:00
src network: prevent dnsmasq from listening on localhost 2012-12-13 12:29:53 -05:00
tests network: prevent dnsmasq from listening on localhost 2012-12-13 12:29:53 -05:00
tools Allow duration=0 for virsh nodesuspend 2012-12-09 16:53:41 -05:00
.dir-locals.el build: avoid tabs that failed syntax-check 2012-09-06 09:43:46 -06:00
.gitignore Autogenerate AUTHORS 2012-10-27 15:07:44 -04:00
.gitmodules make .gnulib a submodule 2009-07-08 16:17:51 +02:00
.mailmap Autogenerate AUTHORS 2012-10-27 15:07:44 -04:00
AUTHORS.in Doug Goldstein gained commit capability 2012-12-09 16:28:00 -05:00
autobuild.sh Switch automated builds to use Mingw64 toolchain instead of Mingw32 2012-06-25 10:41:10 +01:00
autogen.sh build: fix incremental autogen.sh when no AUTHORS is present 2012-12-09 16:53:41 -05:00
bootstrap maint: regenerate bootstrap 2012-07-27 09:34:04 -06:00
bootstrap.conf Autogenerate AUTHORS 2012-10-27 15:07:44 -04:00
cfg.mk build: fix incremental autogen.sh when no AUTHORS is present 2012-12-09 16:53:41 -05:00
ChangeLog-old virterror.c: Fix several spelling mistakes 2012-02-03 11:32:51 -07:00
configure.ac Prep for release 0.10.2.2 2012-12-09 18:21:26 -05:00
COPYING.LIB remove all trailing blank lines 2009-07-16 15:06:42 +02:00
HACKING Update how to compile with -Werror 2012-10-17 16:18:22 -04:00
libvirt.pc.in build: silence warning from autoconf 2012-05-30 09:22:02 -06:00
libvirt.spec.in Prep for release 0.10.2.2 2012-12-09 18:21:26 -05:00
Makefile.am Autogenerate AUTHORS 2012-10-27 15:07:44 -04:00
Makefile.nonreentrant Ban use of all inet_* functions 2010-10-22 11:59:23 +01:00
mingw-libvirt.spec.in parallels: add driver skeleton 2012-08-01 11:44:26 +08:00
README Correct typos in the documentation (Atsushi SAKAI) 2008-01-24 10:15:13 +00:00
README-hacking maint: relax git minimum version 2010-02-24 14:29:27 -05:00
run.in syntax-check: fix run.in 2012-09-18 13:59:53 +02:00
TODO Update todo list file to point at bugzilla/website 2010-10-13 16:45:26 +01:00

README 

         LibVirt : simple API for virtualization

  Libvirt is a C toolkit to interact with the virtualization capabilities
of recent versions of Linux (and other OSes). It is free software
available under the GNU Lesser General Public License. Virtualization of
the Linux Operating System means the ability to run multiple instances of
Operating Systems concurrently on a single hardware system where the basic
resources are driven by a Linux instance. The library aim at providing
long term stable C API initially for the Xen paravirtualization but
should be able to integrate other virtualization mechanisms if needed.

Daniel Veillard <veillard@redhat.com>