network: prevent dnsmasq from listening on localhost

This patch resolves the problem reported in:

   https://bugzilla.redhat.com/show_bug.cgi?id=886663

The source of the problem was the fix for CVE 2011-3411:

   https://bugzilla.redhat.com/show_bug.cgi?id=833033

which was originally committed upstream in commit
753ff83a50263d6975f88d6605d4b5ddfcc97560. That commit improperly
removed the "--except-interface lo" from dnsmasq commandlines when
--bind-dynamic was used (based on comments in the latter bug).

It turns out that the problem reported in the CVE could be eliminated
without removing "--except-interface lo", and removing it actually
caused each instance of dnsmasq to listen on localhost on port 53,
which created a new problem:

If another instance of dnsmasq using "bind-interfaces" (instead of
"bind-dynamic") had already been started (or if another instance
started later used "bind-dynamic"), this wouldn't have any immediately
visible ill effects, but if you tried to start another dnsmasq
instance using "bind-interfaces" *after* starting any libvirt
networks, the new dnsmasq would fail to start, because there was
already another process listening on port 53.

This patch changes the network driver to *always* add
"except-interface=lo" to dnsmasq conf files, regardless of whether we use
bind-dynamic or bind-interfaces. This way no libvirt dnsmasq instances
are listening on localhost (and the CVE is still fixed).

The actual code change is miniscule, but must be propogated through all
of the test files as well.

(This is *not* a cherry-pick of the upstream commit that fixes the bug
(commit d66eb7866757dd371560c288dc6201fb9348792a), because subsequent
to the CVE fix, another patch changed the network driver to put
dnsmasq options in a conf file rather than directly on the dnsmasq
commandline preserving the same options), so a cherry-pick is just one
very large conflict.)

diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
index 8010797d6cb59a00949a90844147ae41eeffb991..6053770727bd41dc9274365a473c4fddd67acf2d 100644 (file)
--- a/src/network/bridge_driver.c
+++ b/src/network/bridge_driver.c
@@ -510,6 +510,9 @@ networkBuildDnsmasqArgv(virNetworkObjPtr network,
     /* *no* conf file */
     virCommandAddArg(cmd, "--conf-file=");
 
+    /* dnsmasq will *always* listen on localhost unless told otherwise */
+    virCommandAddArgList(cmd, "--except-interface", "lo", NULL);
+
     if (dnsmasqCapsGet(caps, DNSMASQ_CAPS_BIND_DYNAMIC)) {
         /* using --bind-dynamic with only --interface (no
          * --listen-address) prevents dnsmasq from responding to dns
@@ -523,10 +526,7 @@ networkBuildDnsmasqArgv(virNetworkObjPtr network,
                              "--interface", network->def->bridge,
                              NULL);
     } else {
-        virCommandAddArgList(cmd,
-                             "--bind-interfaces",
-                             "--except-interface", "lo",
-                             NULL);
+        virCommandAddArg(cmd, "--bind-interfaces");
         /*
          * --interface does not actually work with dnsmasq < 2.47,
          * due to DAD for ipv6 addresses on the interface.

diff --git a/tests/networkxml2argvdata/isolated-network.argv b/tests/networkxml2argvdata/isolated-network.argv
index d629192e88fb8fb14da2275f6168fd80f9453922..d91c730afcae7846b1544e7d481213628275bb2a 100644 (file)
--- a/tests/networkxml2argvdata/isolated-network.argv
+++ b/tests/networkxml2argvdata/isolated-network.argv
@@ -1,6 +1,6 @@
 @DNSMASQ@ --strict-order \
 --local=// --domain-needed --conf-file= \
---bind-interfaces --except-interface lo \
+--except-interface lo --bind-interfaces \
 --listen-address 192.168.152.1 \
 --dhcp-option=3 --no-resolv \
 --dhcp-range 192.168.152.2,192.168.152.254 \

diff --git a/tests/networkxml2argvdata/nat-network-dns-hosts.argv b/tests/networkxml2argvdata/nat-network-dns-hosts.argv
index e5143acbbecb6ec518a457c2c423547d2946514f..431e98744f404863dc5781015e135ed9d47f1e4d 100644 (file)
--- a/tests/networkxml2argvdata/nat-network-dns-hosts.argv
+++ b/tests/networkxml2argvdata/nat-network-dns-hosts.argv
@@ -1,5 +1,5 @@
 @DNSMASQ@ --strict-order --domain=example.com \
 --local=/example.com/ --domain-needed \
 --conf-file= \
---bind-dynamic --interface virbr0 \
+--except-interface lo --bind-dynamic --interface virbr0 \
 --expand-hosts --addn-hosts=/var/lib/libvirt/dnsmasq/default.addnhosts\

diff --git a/tests/networkxml2argvdata/nat-network-dns-srv-record-minimal.argv b/tests/networkxml2argvdata/nat-network-dns-srv-record-minimal.argv
index c38b954979ae5eff449c34ea4ca475934acb9e9f..9c26f32361cf26f202198f9749c547bf8cd2cace 100644 (file)
--- a/tests/networkxml2argvdata/nat-network-dns-srv-record-minimal.argv
+++ b/tests/networkxml2argvdata/nat-network-dns-srv-record-minimal.argv
@@ -1,7 +1,7 @@
 @DNSMASQ@ \
 --strict-order \
 --local=// --domain-needed --conf-file= \
---bind-interfaces --except-interface lo \
+--except-interface lo --bind-interfaces \
 --listen-address 192.168.122.1 \
 --listen-address 192.168.123.1 \
 --listen-address fc00:db8:ac10:fe01::1 \

diff --git a/tests/networkxml2argvdata/nat-network-dns-srv-record.argv b/tests/networkxml2argvdata/nat-network-dns-srv-record.argv
index 311b0d76f923ebef44d0ba65c80fcfed0d9a006c..ff9c223bf6c7f39ba1433a2bdd1dfd12c199b6a9 100644 (file)
--- a/tests/networkxml2argvdata/nat-network-dns-srv-record.argv
+++ b/tests/networkxml2argvdata/nat-network-dns-srv-record.argv
@@ -1,7 +1,7 @@
 @DNSMASQ@ \
 --strict-order \
 --local=// --domain-needed --conf-file= \
---bind-dynamic --interface virbr0 \
+--except-interface lo --bind-dynamic --interface virbr0 \
 --srv-host=name.tcp.test-domain-name,.,1024,10,10 \
 --dhcp-range 192.168.122.2,192.168.122.254 \
 --dhcp-leasefile=/var/lib/libvirt/dnsmasq/default.leases \

diff --git a/tests/networkxml2argvdata/nat-network-dns-txt-record.argv b/tests/networkxml2argvdata/nat-network-dns-txt-record.argv
index cbdf50db9a1f57ad8a9ec2cf62f7be388df29105..2b133ff9a6088f231b66eb258abaa7b479fe2ae2 100644 (file)
--- a/tests/networkxml2argvdata/nat-network-dns-txt-record.argv
+++ b/tests/networkxml2argvdata/nat-network-dns-txt-record.argv
@@ -1,6 +1,6 @@
 @DNSMASQ@ --strict-order \
 --local=// --domain-needed --conf-file= \
---bind-dynamic --interface virbr0 \
+--except-interface lo --bind-dynamic --interface virbr0 \
 --txt-record=example,example value \
 --dhcp-range 192.168.122.2,192.168.122.254 \
 --dhcp-leasefile=/var/lib/libvirt/dnsmasq/default.leases \

diff --git a/tests/networkxml2argvdata/nat-network.argv b/tests/networkxml2argvdata/nat-network.argv
index 967ca945917dd4dbba45dc164f5b12ccb12d92d7..1a771d08221f05a2a97d68d31cbc69659318661e 100644 (file)
--- a/tests/networkxml2argvdata/nat-network.argv
+++ b/tests/networkxml2argvdata/nat-network.argv
@@ -1,6 +1,6 @@
 @DNSMASQ@ --strict-order \
 --local=// --domain-needed --conf-file= \
---bind-dynamic --interface virbr0 \
+--except-interface lo --bind-dynamic --interface virbr0 \
 --dhcp-range 192.168.122.2,192.168.122.254 \
 --dhcp-leasefile=/var/lib/libvirt/dnsmasq/default.leases \
 --dhcp-lease-max=253 --dhcp-no-override \

diff --git a/tests/networkxml2argvdata/netboot-network.argv b/tests/networkxml2argvdata/netboot-network.argv
index bcd6fad5d14ecbb7dc36c1240456997fbb41477e..9f8d1146dd65b45ea3783455ea154a906fd6cbf0 100644 (file)
--- a/tests/networkxml2argvdata/netboot-network.argv
+++ b/tests/networkxml2argvdata/netboot-network.argv
@@ -1,6 +1,6 @@
 @DNSMASQ@ --strict-order --domain=example.com \
 --local=/example.com/ --domain-needed --conf-file= \
---bind-interfaces --except-interface lo --listen-address 192.168.122.1 \
+--except-interface lo --bind-interfaces --listen-address 192.168.122.1 \
 --dhcp-range 192.168.122.2,192.168.122.254 \
 --dhcp-leasefile=/var/lib/libvirt/dnsmasq/netboot.leases \
 --dhcp-lease-max=253 --dhcp-no-override --expand-hosts --enable-tftp \

diff --git a/tests/networkxml2argvdata/netboot-proxy-network.argv b/tests/networkxml2argvdata/netboot-proxy-network.argv
index 8c5ef9bf443dc2455b688b5ffeca0b87fa08e51c..90a31e2b459de73cd6b68e36a11521eef1b81d04 100644 (file)
--- a/tests/networkxml2argvdata/netboot-proxy-network.argv
+++ b/tests/networkxml2argvdata/netboot-proxy-network.argv
@@ -1,6 +1,6 @@
 @DNSMASQ@ --strict-order --domain=example.com \
 --local=/example.com/ --domain-needed --conf-file= \
---bind-interfaces --except-interface lo \
+--except-interface lo --bind-interfaces \
 --listen-address 192.168.122.1 \
 --dhcp-range 192.168.122.2,192.168.122.254 \
 --dhcp-leasefile=/var/lib/libvirt/dnsmasq/netboot.leases \

diff --git a/tests/networkxml2argvdata/routed-network.argv b/tests/networkxml2argvdata/routed-network.argv
index eacdf2d70a36f8ccf358d74cef39766aa8145aab..862013e6c02456c8f6ab865780c779eacabb62c6 100644 (file)
--- a/tests/networkxml2argvdata/routed-network.argv
+++ b/tests/networkxml2argvdata/routed-network.argv
@@ -1,3 +1,3 @@
 @DNSMASQ@ --strict-order \
 --local=// --domain-needed --conf-file= \
---bind-dynamic --interface virbr1\
+--except-interface lo --bind-dynamic --interface virbr1\