NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2025-02-25 18:55:26 -06:00
Code Issues Packages Projects Releases Wiki Activity

tools: ssh-proxy: Check for domain status before parsing its CID

Browse Source 
Inactive domain XML can be wildly different to the live XML. For
instance, it can have VSOCK CID of that from another (running)
domain. Since domain status is not checked for, attempting to ssh
into an inactive domain may in fact result in opening a
connection to a different live domain that listens on said CID
currently.

Resolves: https://gitlab.com/libvirt/libvirt/-/issues/737
Resolves: https://issues.redhat.com/browse/RHEL-75577

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
This commit is contained in:
Michal Privoznik 2025-01-21 12:36:48 +01:00
parent 63a3d70697
commit ab10c0695d
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
tools/ssh-proxy/ssh-proxy.c
View File

@ -194,7 +194,10 @@ lookupDomainAndFetchCID(const char *uri,
if (virStrToLong_i(domname, NULL, 10, &id) >= 0)
dom = virDomainLookupByID(conn, id);
}
if (!dom)
/* If no domain is found, return an error. Similarly, inactive domain may
* contain CID of another (running) domain, yielding misleading results. */
if (!dom || virDomainIsActive(dom) <= 0)
return -1;
return extractCID(dom, cid);