External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-07-11 04:15:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Libvirt provides a portable, long term stable C API for managing the virtualization technologies provided by many operating systems. It includes support for QEMU, KVM, Xen, LXC, bhyve, Virtuozzo, VMware vCenter and ESX, VMware Desktop, Hyper-V, VirtualBox and the POWER Hypervisor.
11,619 Commits 67 Branches 615 Tags 716 MiB
C 94.8%
Python 2%
Meson 0.9%
Shell 0.8%
Dockerfile 0.7%
Other 0.7%
d66eb78667
Go to file
Laine Stump d66eb78667 network: prevent dnsmasq from listening on localhost 
This patch resolves the problem reported in:

   https://bugzilla.redhat.com/show_bug.cgi?id=886663

The source of the problem was the fix for CVE 2011-3411:

   https://bugzilla.redhat.com/show_bug.cgi?id=833033

which was originally committed upstream in commit
753ff83a50. That commit improperly
removed the "--except-interface lo" from dnsmasq commandlines when
--bind-dynamic was used (based on comments in the latter bug).

It turns out that the problem reported in the CVE could be eliminated
without removing "--except-interface lo", and removing it actually
caused each instance of dnsmasq to listen on localhost on port 53,
which created a new problem:

If another instance of dnsmasq using "bind-interfaces" (instead of
"bind-dynamic") had already been started (or if another instance
started later used "bind-dynamic"), this wouldn't have any immediately
visible ill effects, but if you tried to start another dnsmasq
instance using "bind-interfaces" *after* starting any libvirt
networks, the new dnsmasq would fail to start, because there was
already another process listening on port 53.

(Subsequent to the CVE fix, another patch changed the network driver
to put dnsmasq options in a conf file rather than directly on the
dnsmasq commandline, but preserved the same options.)

This patch changes the network driver to *always* add
"except-interface=lo" to dnsmasq conf files, regardless of whether we use
bind-dynamic or bind-interfaces. This way no libvirt dnsmasq instances
are listening on localhost (and the CVE is still fixed).

The actual code change is miniscule, but must be propogated through all
of the test files as well.
2012-12-13 12:15:03 -05:00
.gnulib@d245e6ddd6 maint: update to latest gnulib 2012-10-22 20:25:44 -06:00
build-aux Document bracket whitespace rules & add syntax-check rule 2012-11-02 14:00:32 +00:00
daemon Inhibit daemon shutdown during driver initialization 2012-12-06 20:27:09 +01:00
docs docs: Document offline migration 2012-12-11 20:46:31 +01:00
examples examples: Fix balloon event callback 2012-12-11 13:25:50 +01:00
gnulib build: fix fresh checkout on RHEL5 2012-04-19 17:11:43 -06:00
include Add support for offline migration 2012-12-10 21:52:15 +01:00
m4 build: improve FORTIFY_SOURCE usage 2012-10-23 14:00:32 -06:00
po Add a virtlockd client as a lock driver impl 2012-12-13 15:26:57 +00:00
python Fix the indention 2012-12-04 23:41:35 +08:00
src network: prevent dnsmasq from listening on localhost 2012-12-13 12:15:03 -05:00
tests network: prevent dnsmasq from listening on localhost 2012-12-13 12:15:03 -05:00
tools virsh: use vshReconnect for non-default connections too 2012-12-13 16:39:38 +01:00
.dir-locals.el build: avoid tabs that failed syntax-check 2012-09-06 09:43:46 -06:00
.gitignore Add a virtlockd client as a lock driver impl 2012-12-13 15:26:57 +00:00
.gitmodules
.mailmap Autogenerate AUTHORS 2012-10-19 12:44:56 -04:00
AUTHORS.in Doug Goldstein gained commit capability 2012-11-15 09:34:01 +08:00
autobuild.sh Switch automated builds to use Mingw64 toolchain instead of Mingw32 2012-06-25 10:41:10 +01:00
autogen.sh build: fix incremental autogen.sh when no AUTHORS is present 2012-12-03 14:59:09 -07:00
bootstrap maint: regenerate bootstrap 2012-07-27 09:34:04 -06:00
bootstrap.conf Add ability to maintain disk leases indirectly 2012-12-13 15:26:57 +00:00
cfg.mk Define a wire protocol for talking to the virtlockd daemon 2012-12-13 15:26:57 +00:00
ChangeLog-old virterror.c: Fix several spelling mistakes 2012-02-03 11:32:51 -07:00
configure.ac Qemu FreeBSD: fix compilation 2012-12-12 11:59:53 -07:00
COPYING.LIB
HACKING Document bracket whitespace rules & add syntax-check rule 2012-11-02 14:00:32 +00:00
libvirt.pc.in build: silence warning from autoconf 2012-05-30 09:22:02 -06:00
libvirt.spec.in Add support for re-exec() of virtlockd upon SIGUSR1 2012-12-13 15:26:57 +00:00
Makefile.am maint: mention when HACKING is rebuilt during make 2012-12-11 13:35:33 -07:00
Makefile.nonreentrant Ban use of all inet_* functions 2010-10-22 11:59:23 +01:00
mingw-libvirt.spec.in parallels: add driver skeleton 2012-08-01 11:44:26 +08:00
README
README-hacking maint: relax git minimum version 2010-02-24 14:29:27 -05:00
run.in Add a virtlockd client as a lock driver impl 2012-12-13 15:26:57 +00:00
TODO Update todo list file to point at bugzilla/website 2010-10-13 16:45:26 +01:00

README 

         LibVirt : simple API for virtualization

  Libvirt is a C toolkit to interact with the virtualization capabilities
of recent versions of Linux (and other OSes). It is free software
available under the GNU Lesser General Public License. Virtualization of
the Linux Operating System means the ability to run multiple instances of
Operating Systems concurrently on a single hardware system where the basic
resources are driven by a Linux instance. The library aim at providing
long term stable C API initially for the Xen paravirtualization but
should be able to integrate other virtualization mechanisms if needed.

Daniel Veillard <veillard@redhat.com>