External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-29 00:55:22 +00:00
Code Issues Packages Projects Releases Wiki Activity
84cbd3a98a
libvirt/tests
History
Laine Stump 84cbd3a98a network: prevent dnsmasq from listening on localhost 
This patch resolves the problem reported in:

   https://bugzilla.redhat.com/show_bug.cgi?id=886663

The source of the problem was the fix for CVE 2011-3411:

   https://bugzilla.redhat.com/show_bug.cgi?id=833033

which was originally committed upstream in commit
753ff83a50. That commit improperly
removed the "--except-interface lo" from dnsmasq commandlines when
--bind-dynamic was used (based on comments in the latter bug).

It turns out that the problem reported in the CVE could be eliminated
without removing "--except-interface lo", and removing it actually
caused each instance of dnsmasq to listen on localhost on port 53,
which created a new problem:

If another instance of dnsmasq using "bind-interfaces" (instead of
"bind-dynamic") had already been started (or if another instance
started later used "bind-dynamic"), this wouldn't have any immediately
visible ill effects, but if you tried to start another dnsmasq
instance using "bind-interfaces" *after* starting any libvirt
networks, the new dnsmasq would fail to start, because there was
already another process listening on port 53.

This patch changes the network driver to *always* add
"except-interface=lo" to dnsmasq conf files, regardless of whether we use
bind-dynamic or bind-interfaces. This way no libvirt dnsmasq instances
are listening on localhost (and the CVE is still fixed).

The actual code change is miniscule, but must be propogated through all
of the test files as well.

(This is *not* a cherry-pick of the upstream commit that fixes the bug
(commit d66eb78667), because subsequent
to the CVE fix, another patch changed the network driver to put
dnsmasq options in a conf file rather than directly on the dnsmasq
commandline preserving the same options), so a cherry-pick is just one
very large conflict.)
2012-12-13 12:29:53 -05:00
..
capabilityschemadata Update xml schemas according to libvirt source 2012-08-02 14:36:23 -06:00
commanddata command: shell-quote when logging commands 2012-08-31 08:10:58 -07:00
confdata Change the default of mdns_adv to false 2012-03-27 09:54:49 -06:00
cputestdata
domainschemadata parallels: implement containers creation 2012-09-13 21:19:58 +08:00
domainsnapshotxml2xmlin
domainsnapshotxml2xmlout
interfaceschemadata
lxcxml2xmldata numad: Always output 'placement' of <vcpu> 2012-05-08 16:57:37 -06:00
networkxml2argvdata network: prevent dnsmasq from listening on localhost 2012-12-13 12:29:53 -05:00
networkxml2xmlin conf: parser/formatter/rng for <forward mode='hostdev'> 2012-08-17 15:43:26 -04:00
networkxml2xmlout conf: parser/formatter/rng for <forward mode='hostdev'> 2012-08-17 15:43:26 -04:00
nodedevschemadata Update xml schemas according to libvirt source 2012-08-02 14:36:23 -06:00
nodeinfodata tests: reduce length of nodeinfodata test names 2012-07-20 15:36:11 -06:00
nwfilterxml2xmlin nwfilter: Add support for ipset 2012-05-21 06:26:34 -04:00
nwfilterxml2xmlout nwfilter: Add support for ipset 2012-05-21 06:26:34 -04:00
qemuhelpdata tests: add qemu-1.2.0 help data 2012-09-18 15:43:28 +08:00
qemuxml2argvdata qemu: pass -usb and usb hubs earlier, so USB disks with static address are handled properly 2012-12-09 15:43:01 -05:00
qemuxml2xmloutdata Fix logic for assigning PCI addresses to USB2 companion controllers 2012-05-15 17:07:34 +01:00
qemuxmlnsdata qemu: pass -usb and usb hubs earlier, so USB disks with static address are handled properly 2012-12-09 15:43:01 -05:00
sexpr2xmldata numad: Always output 'placement' of <vcpu> 2012-05-08 16:57:37 -06:00
storagepoolxml2xmlin Update xml schemas according to libvirt source 2012-08-02 14:36:23 -06:00
storagepoolxml2xmlout Update xml schemas according to libvirt source 2012-08-02 14:36:23 -06:00
storagevolxml2xmlin Added timestamps to storage volumes 2012-08-02 17:14:17 -06:00
storagevolxml2xmlout Add a sheepdog backend for the storage driver 2012-07-18 20:08:27 +01:00
vmx2xmldata vmx: handle shared folders parsing 2012-07-21 20:15:02 +02:00
xencapsdata
xmconfigdata numad: Always output 'placement' of <vcpu> 2012-05-08 16:57:37 -06:00
xml2sexprdata Xen: Fix <clock> handling 2012-04-02 09:33:54 -06:00
xml2vmxdata vmx: handle shared folders formatting 2012-07-21 19:45:02 +02:00
.valgrind.supp
capabilityschematest
commandhelper.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
commandtest.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
conftest.c
cpuset use virBitmap to store cpumask info. 2012-09-17 14:59:37 -04:00
cputest.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
define-dev-segfault numad: Always output 'placement' of <vcpu> 2012-05-08 16:57:37 -06:00
domainschematest Add LXC XML files to schema test & fix problems this uncovers 2012-03-27 15:52:25 +01:00
domainsnapshotschematest
domainsnapshotxml2xmltest.c Cleanup for a return statement in source files 2012-03-26 14:45:22 -06:00
esxutilstest.c
eventtest.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
int-overflow
interfaceschematest
interfacexml2xmltest.c Cleanup for a return statement in source files 2012-03-26 14:45:22 -06:00
jsontest.c
libvirtd-fail
libvirtd-pool
libvirtdconftest.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
lxcxml2xmltest.c build: silence recent syntax check violations 2012-03-29 21:23:59 -06:00
Makefile.am New functions for virBitmap 2012-09-17 14:59:36 -04:00
networkschematest
networkxml2argvtest.c util: capabilities detection for dnsmasq 2012-11-29 15:14:20 -05:00
networkxml2xmltest.c conf: parser/formatter/rng for <forward mode='hostdev'> 2012-08-17 15:43:26 -04:00
nodedevschematest
nodedevxml2xmltest.c Cleanup for a return statement in source files 2012-03-26 14:45:22 -06:00
nodeinfotest.c tests: reduce length of nodeinfodata test names 2012-07-20 15:36:11 -06:00
nwfilterschematest
nwfilterxml2xmltest.c nwfilter: Add support for ipset 2012-05-21 06:26:34 -04:00
object-locking.ml maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
oomtrace.pl Remove tabs from all perl files & enforce this 2012-07-30 13:09:57 +01:00
openvzutilstest.c numad: Always output 'placement' of <vcpu> 2012-05-08 16:57:37 -06:00
openvzutilstest.conf
pkix_asn1_tab.c
qemuargv2xmltest.c tests: Add tests for dump-core option 2012-09-20 16:41:07 +02:00
qemuhelptest.c qemu: add support for dump-guest-core option 2012-09-20 16:41:07 +02:00
qemumonitorjsontest.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
qemumonitortest.c
qemumonitortestutils.c Create temporary dir for socket 2012-12-09 16:07:09 -05:00
qemumonitortestutils.h maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
qemuxml2argvtest.c fix kvm_pv_eoi with kvmclock 2012-10-18 13:14:36 -04:00
qemuxml2xmltest.c tests: Add tests for dump-core option 2012-09-20 16:41:07 +02:00
qemuxmlnstest.c Turn QEMU capabilities object into a full virObjectPtr 2012-09-13 12:24:12 +01:00
read-bufsiz maint: avoid regression on copyright listings 2012-07-27 07:42:34 -06:00
read-non-seekable maint: avoid regression on copyright listings 2012-07-27 07:42:34 -06:00
reconnect.c
schematestutils.sh
seclabeltest.c virrandom: make virRandomInitialize an automatic one-shot 2012-08-06 08:15:13 -06:00
securityselinuxhelper.c selinux: Use raw contexts 2012-10-27 14:54:30 -04:00
securityselinuxtest.c selinux: Use raw contexts 2012-10-27 14:54:30 -04:00
sexpr2xmltest.c Convert public datatypes to inherit from virObject 2012-08-07 11:47:41 +01:00
shunloadhelper.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
shunloadtest.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
sockettest.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
ssh.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
start maint: avoid regression on copyright listings 2012-07-27 07:42:34 -06:00
statstest.c Cleanup for a return statement in source files 2012-03-26 14:45:22 -06:00
storagebackendsheepdogtest.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
storagepoolschematest
storagepoolxml2xmltest.c Add a sheepdog backend for the storage driver 2012-07-18 20:08:27 +01:00
storagevolschematest
storagevolxml2xmltest.c Add a sheepdog backend for the storage driver 2012-07-18 20:08:27 +01:00
test_conf.sh
test-lib.sh
testutils.c Move virProcess{Kill,Abort,TranslateStatus} into virprocess.{c,h} 2012-10-17 16:41:06 -04:00
testutils.h maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
testutilslxc.c Add support for setting init argv for LXC 2012-03-27 15:52:25 +01:00
testutilslxc.h Add support for setting init argv for LXC 2012-03-27 15:52:25 +01:00
testutilsqemu.c S390: Adding testcases for s390 2012-07-11 11:19:05 +02:00
testutilsqemu.h
testutilsxen.c
testutilsxen.h
utiltest.c
vcpupin maint: avoid regression on copyright listings 2012-07-27 07:42:34 -06:00
viratomictest.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virauthconfigtest.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virbitmaptest.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virbuftest.c buf: support peeking at string contents 2012-06-11 09:21:27 -06:00
virdrivermoduletest.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virhashdata.h
virhashtest.c Fix format specifiers in test cases on Win32 2012-04-04 14:33:27 +01:00
virkeyfiletest.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virnetmessagetest.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virnetsockettest.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virnettlscontexttest.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
virsh-all Don't check the 'connect' command in virsh-all test 2012-08-07 11:59:08 +01:00
virsh-optparse maint: avoid regression on copyright listings 2012-07-27 07:42:34 -06:00
virsh-schedinfo maint: avoid regression on copyright listings 2012-07-27 07:42:34 -06:00
virsh-synopsis maint: avoid regression on copyright listings 2012-07-27 07:42:34 -06:00
virsh-undefine build: avoid confusing make with raw name 'undefine' 2012-09-12 11:27:22 -06:00
virshtest.c virsh: output scaled values with correct units 2012-05-01 14:58:14 -06:00
virt-aa-helper-test
virtimetest.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
viruritest.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
vmx2xmltest.c vmx: handle shared folders parsing 2012-07-21 20:15:02 +02:00
xencapstest.c Cleanup for a return statement in source files 2012-03-26 14:45:22 -06:00
xmconfigtest.c maint: fix up copyright notice inconsistencies 2012-09-20 16:30:55 -06:00
xml2sexprtest.c Cleanup for a return statement in source files 2012-03-26 14:45:22 -06:00
xml2vmxtest.c vmx: handle shared folders formatting 2012-07-21 19:45:02 +02:00