You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by bh...@apache.org on 2015/08/14 07:21:39 UTC
git commit: updated refs/heads/4.5 to cb2aca7
Repository: cloudstack
Updated Branches:
refs/heads/4.5 3a48171bd -> cb2aca751
CLOUDSTACK-8613, CLOUDSTACK-6301: Dump KVM domain XML with secure flag
When dumping XML use appropriate flags:
1, VIR_DOMAIN_XML_SECURE (dump security sensitive information too)
8, VIR_DOMAIN_XML_MIGRATABLE (dump XML suitable for migration)
Source:
https://libvirt.org/html/libvirt-libvirt-domain.html#virDomainXMLFlags
This fixes CVE 2015-3252: VNC password lost during VM migration across KVM
hosts. The issue is also seen when a VM is rebooted.
Signed-off-by: Rohit Yadav <ro...@shapeblue.com>
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/cb2aca75
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/cb2aca75
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/cb2aca75
Branch: refs/heads/4.5
Commit: cb2aca751630ea60ad2fffed3d12e3fa2a5e93b5
Parents: 3a48171
Author: Rohit Yadav <ro...@shapeblue.com>
Authored: Wed Aug 12 21:03:11 2015 +0530
Committer: Rohit Yadav <ro...@shapeblue.com>
Committed: Fri Aug 14 10:50:55 2015 +0530
----------------------------------------------------------------------
.../kvm/resource/LibvirtComputingResource.java | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/cb2aca75/plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
----------------------------------------------------------------------
diff --git a/plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java b/plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
index 4ceccaa..acd5e94 100755
--- a/plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
+++ b/plugins/hypervisors/kvm/src/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
@@ -3094,8 +3094,13 @@ public class LibvirtComputingResource extends ServerResourceBase implements Serv
description for the instance to be used on the target host.
This is supported by libvirt-java from version 0.50.0
+
+ CVE-2015-3252: Get XML with sensitive information suitable for migration by using
+ VIR_DOMAIN_XML_MIGRATABLE flag (value = 8)
+ https://libvirt.org/html/libvirt-libvirt-domain.html#virDomainXMLFlags
+
*/
- xmlDesc = dm.getXMLDesc(0).replace(_privateIp, cmd.getDestinationIp());
+ xmlDesc = dm.getXMLDesc(8).replace(_privateIp, cmd.getDestinationIp());
dconn = new Connect("qemu+tcp://" + cmd.getDestinationIp() + "/system");
@@ -4510,7 +4515,10 @@ public class LibvirtComputingResource extends ServerResourceBase implements Serv
String msg = null;
try {
dm = conn.domainLookupByName(vmName);
- String vmDef = dm.getXMLDesc(0);
+ // Get XML Dump including the secure information such as VNC password
+ // By passing 1, or VIR_DOMAIN_XML_SECURE flag
+ // https://libvirt.org/html/libvirt-libvirt-domain.html#virDomainXMLFlags
+ String vmDef = dm.getXMLDesc(1);
LibvirtDomainXMLParser parser = new LibvirtDomainXMLParser();
parser.parseDomainXML(vmDef);
for (InterfaceDef nic : parser.getInterfaces()) {