June 2024 - Libguestfs - Libguestfs List Archives

libnbd security: multiple flaws in TLS server certificate checking

by Richard W.M. Jones

Jon Szymaniak contacted us to tell us that libnbd client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This would allow a man-in-the-middle attack on NBD traffic. After investigation we found several separate problems: (1) If you don't specify a certificates directory (eg. with nbd_set_tls_certificates or the URI ?tls-certificates=DIR parameter) then libnbd will use the system's Certificate Authority (CA). However because of a logic flaw this would cause server certificate checking to be skipped. Resolution: https://gitlab.com/nbdkit/libnbd/-/commit/87ef41b69929d5d293390ec36b1c10a... (2) If libnbd doesn't know the server's hostname (eg. because you are connecting over a Unix domain socket, or directly to a pre-opened socket), then all certificate checking was skipped. In this case it should still be possible to check that the CA was correct, but the CA information was ignored. Resolution: https://gitlab.com/nbdkit/libnbd/-/commit/6ed47a27d14f6f11946bb096d94e5bf... (3) There was a lack of testing of this. Resolution: Tests have been added upstream and in CI. While investigating Daniel P. Berrange pointed out these additional flaws: (4) On very old platforms (eg. RHEL 7) GnuTLS lacks the gnutls_session_set_verify_cert API that we use to check peer certificates, and we silently skipped the check entirely. We feel it is safer to disable TLS entirely for these platforms. Attempts to use TLS will give an error. Resolution: https://gitlab.com/nbdkit/libnbd/-/commit/5ff09cdbbd19226dd2d5015d76134f8... (5) There is no way to set the TLS hostname of the server separate from the name of the server that we are connecting to. If we are connecting to the ultimate server through a proxy then this means that we cannot verify the name of the server in the certificate presented by the server. Also if using a pre-opened socket this allows the server hostname to be supplied by some out of band means. Resolution: Add new nbd_set_tls_hostname and nbd_get_tls_hostname APIs: https://gitlab.com/nbdkit/libnbd/-/commit/7a45b5db68c59cc620ba328f0ebec1e... Allow ?tls-hostname=HOSTNAME parameter to be added to NBD URIs: https://gitlab.com/nbdkit/libnbd/-/commit/e62185645c4d1a833d40aa79f3fee4e... Fixes will be available in these versions of libnbd: - 1.21.1 (development) - 1.20.2 (stable) - 1.18.5 (stable) Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com virt-builder quickly builds VMs from scratch http://libguestfs.org/virt-builder.1.html

4 months, 4 weeks

1
0
0 / 0

libnbd | Failed pipeline for master | 7ed4454c

by GitLab

Pipeline #1345064882 has failed! Project: libnbd ( https://gitlab.com/nbdkit/libnbd ) Branch: master ( https://gitlab.com/nbdkit/libnbd/-/commits/master ) Commit: 7ed4454c ( https://gitlab.com/nbdkit/libnbd/-/commit/7ed4454cb610858b7aee5dbd90d3710... ) Commit Message: nbdfuse: Can't use ?tls-certificates or ?tls-ps... Commit Author: jon.szymaniak.foss(a)gmail.com Committed by: Richard W_M_ Jones ( https://gitlab.com/rwmjones ) Pipeline #1345064882 ( https://gitlab.com/nbdkit/libnbd/-/pipelines/1345064882 ) triggered by Richard W_M_ Jones ( https://gitlab.com/rwmjones ) had 2 failed jobs. Job #7169673206 ( https://gitlab.com/nbdkit/libnbd/-/jobs/7169673206/raw ) Stage: builds Name: x86_64-alpine-320 Job #7169673207 ( https://gitlab.com/nbdkit/libnbd/-/jobs/7169673207/raw ) Stage: builds Name: x86_64-alpine-edge -- You're receiving this email because of your account on gitlab.com.

5 months

1
0
0 / 0

nbdfuse: Can't use ?tls-certificates or ?tls-psk-file

by jon.szymaniak.foss＠gmail.com

In order to use nbdfuse with TLS it's necessary to add a call to nbd_set_uri_allow_local_file(), as shown in the below patch. However, I'm not familiar enough with the nbdfuse use-cases and motivation for the "allow local file" opt-in to know whether this really should be a command-line argument-based opt in. I'm guessing it should... diff --git a/fuse/nbdfuse.c b/fuse/nbdfuse.c index 628a75c..73eede4 100644 --- a/fuse/nbdfuse.c +++ b/fuse/nbdfuse.c @@ -539,6 +539,9 @@ create_and_connect (enum mode mode, int argc, char **argv) } nbd_set_debug (h, verbose); + /* Allow ?tls-psk-file and ?tls-certificates */ + nbd_set_uri_allow_local_file (h, true); + /* Connect to the NBD server synchronously. */ switch (mode) { case MODE_URI:

5 months

2
1
0 / 0

libnbd | Failed pipeline for master | 4f55ac92

by GitLab

Pipeline #1317929934 has failed! Project: libnbd ( https://gitlab.com/nbdkit/libnbd ) Branch: master ( https://gitlab.com/nbdkit/libnbd/-/commits/master ) Commit: 4f55ac92 ( https://gitlab.com/nbdkit/libnbd/-/commit/4f55ac929577f370169acb3688df968... ) Commit Message: ci: Fix MacOS builds Cirrus requires that we p... Commit Author: Eric Blake ( https://gitlab.com/ebblake ) Pipeline #1317929934 ( https://gitlab.com/nbdkit/libnbd/-/pipelines/1317929934 ) triggered by Eric Blake ( https://gitlab.com/ebblake ) had 2 failed jobs. Job #7015104609 ( https://gitlab.com/nbdkit/libnbd/-/jobs/7015104609/raw ) Stage: builds Name: x86_64-alpine-320 Job #7015104640 ( https://gitlab.com/nbdkit/libnbd/-/jobs/7015104640/raw ) Stage: builds Name: x86_64-alpine-edge -- You're receiving this email because of your account on gitlab.com.

5 months, 2 weeks

1
0
0 / 0

libnbd | Failed pipeline for master | 01c629e2

by GitLab

Pipeline #1317865642 has failed! Project: libnbd ( https://gitlab.com/nbdkit/libnbd ) Branch: master ( https://gitlab.com/nbdkit/libnbd/-/commits/master ) Commit: 01c629e2 ( https://gitlab.com/nbdkit/libnbd/-/commit/01c629e2f05c9339d2c1a79ad05ee6f... ) Commit Message: tests: Fix CI on Fedora 40 Fedora 40 recently ... Commit Author: Eric Blake ( https://gitlab.com/ebblake ) Pipeline #1317865642 ( https://gitlab.com/nbdkit/libnbd/-/pipelines/1317865642 ) triggered by Eric Blake ( https://gitlab.com/ebblake ) had 3 failed jobs. Job #7014652335 ( https://gitlab.com/nbdkit/libnbd/-/jobs/7014652335/raw ) Stage: builds Name: x86_64-alpine-edge Job #7014652587 ( https://gitlab.com/nbdkit/libnbd/-/jobs/7014652587/raw ) Stage: builds Name: aarch64-macos-13 Job #7014652325 ( https://gitlab.com/nbdkit/libnbd/-/jobs/7014652325/raw ) Stage: builds Name: x86_64-alpine-320 -- You're receiving this email because of your account on gitlab.com.

5 months, 2 weeks

1
0
0 / 0

[nbdkit PATCH] tests: Fix CI on Fedora 40

by Eric Blake

Fedora 40 recently changed to move malloc debugging out of glibc into glibc-utils (https://issues.redhat.com/browse/RHEL-35971). Reflect that in our CI, to avoid spurious test failures from tons of messages like: ERROR: ld.so: object 'libc_malloc_debug.so.0' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored. by regenerating with https://gitlab.com/libvirt/libvirt-ci/-/merge_requests/491 Also, change configure.ac to gracefully skip malloc debugging when glibc-utils is not installed. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- I plan on pushing this once my libvirt-ci merge request is accepted (this may need tweaking based on reviews on that side of things) configure.ac | 9 +++++++-- README.md | 1 + ci/buildenv/fedora-39.sh | 1 + ci/buildenv/fedora-40-cross-mingw32.sh | 1 + ci/buildenv/fedora-40-cross-mingw64.sh | 1 + ci/buildenv/fedora-40.sh | 1 + ci/buildenv/fedora-rawhide.sh | 1 + ci/containers/fedora-39.Dockerfile | 1 + ci/containers/fedora-40-cross-mingw32.Dockerfile | 1 + ci/containers/fedora-40-cross-mingw64.Dockerfile | 1 + ci/containers/fedora-40.Dockerfile | 1 + ci/containers/fedora-rawhide.Dockerfile | 1 + ci/lcitool/projects/nbdkit.yml | 1 + 13 files changed, 19 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index aaff4aae..89187b45 100644 --- a/configure.ac +++ b/configure.ac @@ -622,14 +622,19 @@ AS_IF([test "x$is_windows" = "xyes"],[ dnl See if getaddrinfo requires an external library. AC_SEARCH_LIBS([getaddrinfo], [network socket]) -dnl Does this platform require libc_malloc_debug.so.0 (glibc >= 2.34)? +dnl Does this platform support libc_malloc_debug.so.0 (glibc >= 2.34)? AC_MSG_CHECKING([if this is glibc >= 2.34]) AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <limits.h> #if !defined(__GLIBC__) || __GLIBC__ < 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ < 34) #error "not glibc 2.34" #endif - ]])], [is_glibc_234=yes], [is_glibc_234=no] + ]])], + [if (LD_PRELOAD=libc_malloc_debug.so.0 /bin/true) 2>&1 | grep -v .; then + is_glibc_234=yes + else + is_glibc_234='missing suitable libc_malloc_debug.so.0' + fi], [is_glibc_234=no] ) AC_MSG_RESULT([$is_glibc_234]) AM_CONDITIONAL([HAVE_GLIBC_234], [test "x$is_glibc_234" = "xyes"]) diff --git a/README.md b/README.md index 2f9452c8..02ed7644 100644 --- a/README.md +++ b/README.md @@ -184,6 +184,7 @@ For non-essential enhancements to the test suite: * hexdump * ip, ss (from iproute package) * jq +* libc_malloc_debug.so.0 (from glibc-utils) * losetup (from util-linux) * mke2fs (from e2fsprogs) * nbdcopy, nbdinfo, nbdsh (from libnbd) diff --git a/ci/buildenv/fedora-39.sh b/ci/buildenv/fedora-39.sh index 98ee274f..638badbd 100644 --- a/ci/buildenv/fedora-39.sh +++ b/ci/buildenv/fedora-39.sh @@ -25,6 +25,7 @@ function install_buildenv() { gcc-c++ \ genisoimage \ git \ + glibc \ glibc-langpack-en \ gnutls-devel \ golang \ diff --git a/ci/buildenv/fedora-40-cross-mingw32.sh b/ci/buildenv/fedora-40-cross-mingw32.sh index 8de2a5dd..b1638bfa 100644 --- a/ci/buildenv/fedora-40-cross-mingw32.sh +++ b/ci/buildenv/fedora-40-cross-mingw32.sh @@ -22,6 +22,7 @@ function install_buildenv() { genisoimage \ git \ glibc-langpack-en \ + glibc-utils \ golang \ gzip \ iproute \ diff --git a/ci/buildenv/fedora-40-cross-mingw64.sh b/ci/buildenv/fedora-40-cross-mingw64.sh index e7013c38..2965e0e7 100644 --- a/ci/buildenv/fedora-40-cross-mingw64.sh +++ b/ci/buildenv/fedora-40-cross-mingw64.sh @@ -22,6 +22,7 @@ function install_buildenv() { genisoimage \ git \ glibc-langpack-en \ + glibc-utils \ golang \ gzip \ iproute \ diff --git a/ci/buildenv/fedora-40.sh b/ci/buildenv/fedora-40.sh index 98ee274f..5f90faa4 100644 --- a/ci/buildenv/fedora-40.sh +++ b/ci/buildenv/fedora-40.sh @@ -26,6 +26,7 @@ function install_buildenv() { genisoimage \ git \ glibc-langpack-en \ + glibc-utils \ gnutls-devel \ golang \ gzip \ diff --git a/ci/buildenv/fedora-rawhide.sh b/ci/buildenv/fedora-rawhide.sh index 88a8dfdc..e11fe698 100644 --- a/ci/buildenv/fedora-rawhide.sh +++ b/ci/buildenv/fedora-rawhide.sh @@ -27,6 +27,7 @@ function install_buildenv() { genisoimage \ git \ glibc-langpack-en \ + glibc-utils \ gnutls-devel \ golang \ gzip \ diff --git a/ci/containers/fedora-39.Dockerfile b/ci/containers/fedora-39.Dockerfile index bf9f8ff4..0908b026 100644 --- a/ci/containers/fedora-39.Dockerfile +++ b/ci/containers/fedora-39.Dockerfile @@ -36,6 +36,7 @@ exec "$@"\n' > /usr/bin/nosync && \ gcc-c++ \ genisoimage \ git \ + glibc \ glibc-langpack-en \ gnutls-devel \ golang \ diff --git a/ci/containers/fedora-40-cross-mingw32.Dockerfile b/ci/containers/fedora-40-cross-mingw32.Dockerfile index 963b836b..e90b7492 100644 --- a/ci/containers/fedora-40-cross-mingw32.Dockerfile +++ b/ci/containers/fedora-40-cross-mingw32.Dockerfile @@ -33,6 +33,7 @@ exec "$@"\n' > /usr/bin/nosync && \ genisoimage \ git \ glibc-langpack-en \ + glibc-utils \ golang \ gzip \ iproute \ diff --git a/ci/containers/fedora-40-cross-mingw64.Dockerfile b/ci/containers/fedora-40-cross-mingw64.Dockerfile index 58554b97..90f8f752 100644 --- a/ci/containers/fedora-40-cross-mingw64.Dockerfile +++ b/ci/containers/fedora-40-cross-mingw64.Dockerfile @@ -33,6 +33,7 @@ exec "$@"\n' > /usr/bin/nosync && \ genisoimage \ git \ glibc-langpack-en \ + glibc-utils \ golang \ gzip \ iproute \ diff --git a/ci/containers/fedora-40.Dockerfile b/ci/containers/fedora-40.Dockerfile index 1b37f724..2aba9a66 100644 --- a/ci/containers/fedora-40.Dockerfile +++ b/ci/containers/fedora-40.Dockerfile @@ -37,6 +37,7 @@ exec "$@"\n' > /usr/bin/nosync && \ genisoimage \ git \ glibc-langpack-en \ + glibc-utils \ gnutls-devel \ golang \ gzip \ diff --git a/ci/containers/fedora-rawhide.Dockerfile b/ci/containers/fedora-rawhide.Dockerfile index 034f621f..e08dc12b 100644 --- a/ci/containers/fedora-rawhide.Dockerfile +++ b/ci/containers/fedora-rawhide.Dockerfile @@ -38,6 +38,7 @@ exec "$@"\n' > /usr/bin/nosync && \ genisoimage \ git \ glibc-langpack-en \ + glibc-utils \ gnutls-devel \ golang \ gzip \ diff --git a/ci/lcitool/projects/nbdkit.yml b/ci/lcitool/projects/nbdkit.yml index 1f2fe259..979ab23a 100644 --- a/ci/lcitool/projects/nbdkit.yml +++ b/ci/lcitool/projects/nbdkit.yml @@ -23,6 +23,7 @@ packages: - hexdump - ip - jq + - libc-malloc-debug - libcurl - libguestfs - liblzma -- 2.45.1

5 months, 3 weeks

2
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Libguestfs June 2024