cloudstack-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bhais...@apache.org
Subject git commit: updated refs/heads/4.3 to c116ca9
Date Fri, 14 Aug 2015 05:23:42 GMT
Repository: cloudstack
Updated Branches:
  refs/heads/4.3 5de04025a -> c116ca968


CLOUDSTACK-8613, CLOUDSTACK-6301: Dump KVM domain XML with secure flag

When dumping XML use appropriate flags:

1, VIR_DOMAIN_XML_SECURE (dump security sensitive information too)
8, VIR_DOMAIN_XML_MIGRATABLE (dump XML suitable for migration)

Source:
https://libvirt.org/html/libvirt-libvirt-domain.html#virDomainXMLFlags

This fixes CVE 2015-3252: VNC password lost during VM migration across KVM
hosts. The issue is also seen when a VM is rebooted.

Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
(cherry picked from commit cb2aca751630ea60ad2fffed3d12e3fa2a5e93b5)
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>

Conflicts:
	plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java


Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/c116ca96
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/c116ca96
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/c116ca96

Branch: refs/heads/4.3
Commit: c116ca968e552f079e1ebfe855b4bfa02d368f74
Parents: 5de0402
Author: Rohit Yadav <rohit.yadav@shapeblue.com>
Authored: Wed Aug 12 21:03:11 2015 +0530
Committer: Rohit Yadav <rohit.yadav@shapeblue.com>
Committed: Fri Aug 14 10:52:58 2015 +0530

----------------------------------------------------------------------
 .../kvm/resource/LibvirtComputingResource.java        | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/cloudstack/blob/c116ca96/plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
----------------------------------------------------------------------
diff --git a/plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
b/plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
index 0d44109..0f1e2e7 100755
--- a/plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
+++ b/plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
@@ -3011,8 +3011,13 @@ ServerResource {
                 description for the instance to be used on the target host.
 
                 This is supported by libvirt-java from version 0.50.0
-            */
-            xmlDesc = dm.getXMLDesc(0).replace(_privateIp, cmd.getDestinationIp());
+
+                CVE-2015-3252: Get XML with sensitive information suitable for migration
by using
+                               VIR_DOMAIN_XML_MIGRATABLE flag (value = 8)
+                               https://libvirt.org/html/libvirt-libvirt-domain.html#virDomainXMLFlags
+             */
+
+            xmlDesc = dm.getXMLDesc(8).replace(_privateIp, cmd.getDestinationIp());
 
             dconn = new Connect("qemu+tcp://" + cmd.getDestinationIp()
                     + "/system");
@@ -4625,7 +4630,10 @@ ServerResource {
         String msg = null;
         try {
             dm = conn.domainLookupByName(vmName);
-            String vmDef = dm.getXMLDesc(0);
+            // Get XML Dump including the secure information such as VNC password
+            // By passing 1, or VIR_DOMAIN_XML_SECURE flag
+            // https://libvirt.org/html/libvirt-libvirt-domain.html#virDomainXMLFlags
+            String vmDef = dm.getXMLDesc(1);
             LibvirtDomainXMLParser parser = new LibvirtDomainXMLParser();
             parser.parseDomainXML(vmDef);
             for (InterfaceDef nic :parser.getInterfaces()) {


Mime
View raw message