network: prevent dnsmasq from listening on localhost

This patch resolves the problem reported in:

   https://bugzilla.redhat.com/show_bug.cgi?id=886663

The source of the problem was the fix for CVE 2011-3411:

   https://bugzilla.redhat.com/show_bug.cgi?id=833033

which was originally committed upstream in commit
753ff83a50263d6975f88d6605d4b5ddfcc97560. That commit improperly
removed the "--except-interface lo" from dnsmasq commandlines when
--bind-dynamic was used (based on comments in the latter bug).

It turns out that the problem reported in the CVE could be eliminated
without removing "--except-interface lo", and removing it actually
caused each instance of dnsmasq to listen on localhost on port 53,
which created a new problem:

If another instance of dnsmasq using "bind-interfaces" (instead of
"bind-dynamic") had already been started (or if another instance
started later used "bind-dynamic"), this wouldn't have any immediately
visible ill effects, but if you tried to start another dnsmasq
instance using "bind-interfaces" *after* starting any libvirt
networks, the new dnsmasq would fail to start, because there was
already another process listening on port 53.

(Subsequent to the CVE fix, another patch changed the network driver
to put dnsmasq options in a conf file rather than directly on the
dnsmasq commandline, but preserved the same options.)

This patch changes the network driver to *always* add
"except-interface=lo" to dnsmasq conf files, regardless of whether we use
bind-dynamic or bind-interfaces. This way no libvirt dnsmasq instances
are listening on localhost (and the CVE is still fixed).

The actual code change is miniscule, but must be propogated through all
of the test files as well.

diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
index 4e1958d0fd5e305b7ed7d5ecf711e9228f25da6c..a32755d7ab57e5d6798ab2121dce89b70601c33e 100644 (file)
--- a/src/network/bridge_driver.c
+++ b/src/network/bridge_driver.c
@@ -689,6 +689,9 @@ networkDnsmasqConfContents(virNetworkObjPtr network,
      if (pidfile)
         virBufferAsprintf(&configbuf, "pid-file=%s\n", pidfile);
 
+    /* dnsmasq will *always* listen on localhost unless told otherwise */
+    virBufferAddLit(&configbuf, "except-interface=lo\n");
+
     if (dnsmasqCapsGet(caps, DNSMASQ_CAPS_BIND_DYNAMIC)) {
         /* using --bind-dynamic with only --interface (no
          * --listen-address) prevents dnsmasq from responding to dns
@@ -702,9 +705,7 @@ networkDnsmasqConfContents(virNetworkObjPtr network,
                              "interface=%s\n",
                              network->def->bridge);
     } else {
-        virBufferAddLit(&configbuf,
-                             "bind-interfaces\n"
-                             "except-interface=lo\n");
+        virBufferAddLit(&configbuf, "bind-interfaces\n");
         /*
          * --interface does not actually work with dnsmasq < 2.47,
          * due to DAD for ipv6 addresses on the interface.

diff --git a/tests/networkxml2confdata/dhcp6-nat-network.conf b/tests/networkxml2confdata/dhcp6-nat-network.conf
index d4889007a8bf54c01fde3234ced11579618d40fa..050f3dbecc396153aef9d53471b0bae5efcb7b6d 100644 (file)
--- a/tests/networkxml2confdata/dhcp6-nat-network.conf
+++ b/tests/networkxml2confdata/dhcp6-nat-network.conf
@@ -7,6 +7,7 @@
 strict-order
 domain-needed
 local=//
+except-interface=lo
 bind-dynamic
 interface=virbr0
 dhcp-range=192.168.122.2,192.168.122.254

diff --git a/tests/networkxml2confdata/dhcp6-network.conf b/tests/networkxml2confdata/dhcp6-network.conf
index 5c1030c708ac70fb1e8e33838339bca0bb141017..5fde07fbd120a76fa218327aa3f05ba98c8559f8 100644 (file)
--- a/tests/networkxml2confdata/dhcp6-network.conf
+++ b/tests/networkxml2confdata/dhcp6-network.conf
@@ -9,6 +9,7 @@ domain-needed
 domain=mynet
 expand-hosts
 local=/mynet/
+except-interface=lo
 bind-dynamic
 interface=virbr0
 dhcp-range=2001:db8:ac10:fd01::1:10,2001:db8:ac10:fd01::1:ff

diff --git a/tests/networkxml2confdata/dhcp6host-routed-network.conf b/tests/networkxml2confdata/dhcp6host-routed-network.conf
index cb4d0cc41dc815192713502d3e96fe8989eb35e2..f8f05c24c356fedb279a133d881413235e34ba13 100644 (file)
--- a/tests/networkxml2confdata/dhcp6host-routed-network.conf
+++ b/tests/networkxml2confdata/dhcp6host-routed-network.conf
@@ -7,6 +7,7 @@
 strict-order
 domain-needed
 local=//
+except-interface=lo
 bind-dynamic
 interface=virbr1
 dhcp-range=192.168.122.1,static

diff --git a/tests/networkxml2confdata/isolated-network.conf b/tests/networkxml2confdata/isolated-network.conf
index 55a44d32a4743f9367a0084e02742b05f2ca2a63..f8997bda58a8d7348c57f78648391755807f56df 100644 (file)
--- a/tests/networkxml2confdata/isolated-network.conf
+++ b/tests/networkxml2confdata/isolated-network.conf
@@ -7,8 +7,8 @@
 strict-order
 domain-needed
 local=//
-bind-interfaces
 except-interface=lo
+bind-interfaces
 listen-address=192.168.152.1
 dhcp-option=3
 no-resolv

diff --git a/tests/networkxml2confdata/nat-network-dns-hosts.conf b/tests/networkxml2confdata/nat-network-dns-hosts.conf
index ae8f8c5abbfe963481b84f42e02b34749f408c3b..2577882958a7515dc38f1aaaa1ca6fe8f71d2296 100644 (file)
--- a/tests/networkxml2confdata/nat-network-dns-hosts.conf
+++ b/tests/networkxml2confdata/nat-network-dns-hosts.conf
@@ -9,6 +9,7 @@ domain-needed
 domain=example.com
 expand-hosts
 local=/example.com/
+except-interface=lo
 bind-dynamic
 interface=virbr0
 addn-hosts=/var/lib/libvirt/dnsmasq/default.addnhosts

diff --git a/tests/networkxml2confdata/nat-network-dns-srv-record-minimal.conf b/tests/networkxml2confdata/nat-network-dns-srv-record-minimal.conf
index faa36e697d13949d39209d28fccaa583da16a87c..1e9b59c512e6863ab8d2b99aea22eaef058b373b 100644 (file)
--- a/tests/networkxml2confdata/nat-network-dns-srv-record-minimal.conf
+++ b/tests/networkxml2confdata/nat-network-dns-srv-record-minimal.conf
@@ -7,8 +7,8 @@
 strict-order
 domain-needed
 local=//
-bind-interfaces
 except-interface=lo
+bind-interfaces
 listen-address=192.168.122.1
 listen-address=192.168.123.1
 listen-address=fc00:db8:ac10:fe01::1

diff --git a/tests/networkxml2confdata/nat-network-dns-srv-record.conf b/tests/networkxml2confdata/nat-network-dns-srv-record.conf
index 60799121fed43301188f440f25339c7a127f5613..53d044a40c8a1e9546f500620eef5a66d0400643 100644 (file)
--- a/tests/networkxml2confdata/nat-network-dns-srv-record.conf
+++ b/tests/networkxml2confdata/nat-network-dns-srv-record.conf
@@ -7,6 +7,7 @@
 strict-order
 domain-needed
 local=//
+except-interface=lo
 bind-dynamic
 interface=virbr0
 srv-host=name.tcp.test-domain-name,.,1024,10,10

diff --git a/tests/networkxml2confdata/nat-network-dns-txt-record.conf b/tests/networkxml2confdata/nat-network-dns-txt-record.conf
index c448bdc1bcd30a154871b297c777b3b11d92dbd9..921cae1607154682abc2d60f1d8e2abbb2a44d91 100644 (file)
--- a/tests/networkxml2confdata/nat-network-dns-txt-record.conf
+++ b/tests/networkxml2confdata/nat-network-dns-txt-record.conf
@@ -7,6 +7,7 @@
 strict-order
 domain-needed
 local=//
+except-interface=lo
 bind-dynamic
 interface=virbr0
 txt-record=example,example value

diff --git a/tests/networkxml2confdata/nat-network.conf b/tests/networkxml2confdata/nat-network.conf
index 8f28fef0791adb4bc59119599ad08648584d0e84..beb714b134c3401281ad76e3713cf51537308406 100644 (file)
--- a/tests/networkxml2confdata/nat-network.conf
+++ b/tests/networkxml2confdata/nat-network.conf
@@ -7,6 +7,7 @@
 strict-order
 domain-needed
 local=//
+except-interface=lo
 bind-dynamic
 interface=virbr0
 dhcp-range=192.168.122.2,192.168.122.254

diff --git a/tests/networkxml2confdata/netboot-network.conf b/tests/networkxml2confdata/netboot-network.conf
index 83dd2b3eb3323aab502cf6a371e9c60d8aeef583..b6f3c23f150f6c5995e68f32be3b518ec8fff047 100644 (file)
--- a/tests/networkxml2confdata/netboot-network.conf
+++ b/tests/networkxml2confdata/netboot-network.conf
@@ -9,8 +9,8 @@ domain-needed
 domain=example.com
 expand-hosts
 local=/example.com/
-bind-interfaces
 except-interface=lo
+bind-interfaces
 listen-address=192.168.122.1
 dhcp-range=192.168.122.2,192.168.122.254
 dhcp-no-override

diff --git a/tests/networkxml2confdata/netboot-proxy-network.conf b/tests/networkxml2confdata/netboot-proxy-network.conf
index b266d81ab8aaea3404f050f7166702f9862d63b0..1e969fac6b6311df9b806267250184ba7ab35318 100644 (file)
--- a/tests/networkxml2confdata/netboot-proxy-network.conf
+++ b/tests/networkxml2confdata/netboot-proxy-network.conf
@@ -9,8 +9,8 @@ domain-needed
 domain=example.com
 expand-hosts
 local=/example.com/
-bind-interfaces
 except-interface=lo
+bind-interfaces
 listen-address=192.168.122.1
 dhcp-range=192.168.122.2,192.168.122.254
 dhcp-no-override

diff --git a/tests/networkxml2confdata/routed-network.conf b/tests/networkxml2confdata/routed-network.conf
index dc53a4e1c8c308d077fb35102af9a8057de22952..62ffd7a29a9d985300c5ae25c392321b2c1a8413 100644 (file)
--- a/tests/networkxml2confdata/routed-network.conf
+++ b/tests/networkxml2confdata/routed-network.conf
@@ -7,6 +7,7 @@
 strict-order
 domain-needed
 local=//
+except-interface=lo
 bind-dynamic
 interface=virbr1
 addn-hosts=/var/lib/libvirt/dnsmasq/local.addnhosts