1. 07 9月, 2017 2 次提交
  2. 06 9月, 2017 1 次提交
  3. 05 9月, 2017 6 次提交
  4. 04 9月, 2017 4 次提交
  5. 01 9月, 2017 3 次提交
  6. 31 8月, 2017 2 次提交
  7. 30 8月, 2017 3 次提交
    • P
      qemu: set bind mode for chardev while parsing XML · be6a415e
      Pavel Hrdina 提交于
      Currently while parsing domain XML we clear the UNIX path if it matches
      one of the auto-generated paths by libvirt.  After that when the guest
      is started new path is generated but the mode is also changed to "bind".
      
      In the real-world use-case the mode should not change, it only happens
      if a user provides a mode='connect' and path that matches one of the
      auto-generated path or not provides a path at all.
      
      Before *reconnect* feature was introduced there was no issue, but with
      the new feature we need to make sure that it's used only with "connect"
      mode, therefore we need to move the mode change into parsing in order
      to have a proper error reported by validation code.
      Signed-off-by: NPavel Hrdina <phrdina@redhat.com>
      be6a415e
    • P
      conf: add reconnect to virDomainChrSourceDef(Copy|IsEqual) · 39354391
      Pavel Hrdina 提交于
      Missed by 9aa72a6d.
      Signed-off-by: NPavel Hrdina <phrdina@redhat.com>
      39354391
    • D
      rpc: avoid ssh interpreting malicious hostname as arguments · e4cb8500
      Daniel P. Berrange 提交于
      Inspired by the recent GIT / Mercurial security flaws
      (http://blog.recurity-labs.com/2017-08-10/scm-vulns),
      consider someone/something manages to feed libvirt a bogus
      URI such as:
      
        virsh -c qemu+ssh://-oProxyCommand=gnome-calculator/system
      
      In this case, the hosname "-oProxyCommand=gnome-calculator"
      will get interpreted as an argument to ssh, not a hostname.
      Fortunately, due to the set of args we have following the
      hostname, SSH will then interpret our bit of shell script
      that runs 'nc' on the remote host as a cipher name, which is
      clearly invalid. This makes ssh exit during argv parsing and
      so it never tries to run gnome-calculator.
      
      We are lucky this time, but lets be more paranoid, by using
      '--' to explicitly tell SSH when it has finished seeing
      command line options. This forces it to interpret
      "-oProxyCommand=gnome-calculator" as a hostname, and thus
      see a fail from hostname lookup.
      Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
      e4cb8500
  8. 29 8月, 2017 19 次提交