mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 02:01:24 +01:00
Roger Pau Monne
54d8f27d04
Allow administrators to notify a frontend driver that it's backend counterpart is not to be trusted, so the frontend can deploy whatever mitigations required in order to secure itself. Allow such option for disk and network frontends only, as those are the only hardened ones currently supported. This is part of XSA-403 Signed-off-by: Roger Pau Monné <roger.pau@citrix.com> Reviewed-by: Anthony PERARD <anthony.perard@citrix.com>
208 lines
4.1 KiB
Bash
Executable File
208 lines
4.1 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
set -e
|
|
|
|
if [ -x ./xl ] ; then
|
|
export LD_LIBRARY_PATH=.:../libxc:../xenstore
|
|
XL=./xl
|
|
else
|
|
XL=xl
|
|
fi
|
|
|
|
fprefix=tmp.check-xl-disk-parse
|
|
|
|
expected () {
|
|
cat >$fprefix.expected
|
|
}
|
|
|
|
failures=0
|
|
|
|
one () {
|
|
expected_rc=$1; shift
|
|
printf "test case %s...\n" "$*"
|
|
set +e
|
|
${XL} -N block-attach 0 "$@" </dev/null >$fprefix.actual 2>/dev/null
|
|
actual_rc=$?
|
|
diff -u $fprefix.expected $fprefix.actual
|
|
diff_rc=$?
|
|
set -e
|
|
if [ $actual_rc != $expected_rc ] || [ $diff_rc != 0 ]; then
|
|
echo >&2 "test case \`$*' failed ($actual_rc $diff_rc)"
|
|
failures=$(( $failures + 1 ))
|
|
fi
|
|
}
|
|
|
|
complete () {
|
|
if [ "$failures" = 0 ]; then
|
|
echo all ok.; exit 0
|
|
else
|
|
echo "$failures tests failed."; exit 1
|
|
fi
|
|
}
|
|
|
|
e=1
|
|
|
|
|
|
#---------- test data ----------
|
|
#
|
|
# culled from docs/misc/xl-disk-configuration.txt
|
|
|
|
expected </dev/null
|
|
one $e foo
|
|
|
|
expected <<END
|
|
disk: {
|
|
"pdev_path": "/dev/vg/guest-volume",
|
|
"vdev": "hda",
|
|
"format": "raw",
|
|
"readwrite": 1
|
|
}
|
|
|
|
END
|
|
one 0 /dev/vg/guest-volume,,hda
|
|
one 0 /dev/vg/guest-volume,raw,hda,rw
|
|
one 0 "format=raw, vdev=hda, access=rw, target=/dev/vg/guest-volume"
|
|
one 0 format=raw vdev=hda access=rw target=/dev/vg/guest-volume
|
|
one 0 raw:/dev/vg/guest-volume,hda,w
|
|
|
|
expected <<END
|
|
disk: {
|
|
"pdev_path": "/root/image.iso",
|
|
"vdev": "hdc",
|
|
"format": "raw",
|
|
"removable": 1,
|
|
"is_cdrom": 1
|
|
}
|
|
|
|
END
|
|
one 0 /root/image.iso,,hdc,cdrom
|
|
one 0 /root/image.iso,,hdc,,cdrom
|
|
one 0 /root/image.iso,raw,hdc,devtype=cdrom
|
|
one 0 "format=raw, vdev=hdc, access=ro, devtype=cdrom, target=/root/image.iso"
|
|
one 0 format=raw vdev=hdc access=ro devtype=cdrom target=/root/image.iso
|
|
one 0 raw:/root/image.iso,hdc:cdrom,ro
|
|
|
|
expected <<EOF
|
|
disk: {
|
|
"pdev_path": "/dev/vg/guest-volume",
|
|
"vdev": "xvdb",
|
|
"backend": "phy",
|
|
"format": "raw",
|
|
"readwrite": 1
|
|
}
|
|
|
|
EOF
|
|
one 0 backendtype=phy,vdev=xvdb,access=w,target=/dev/vg/guest-volume
|
|
|
|
expected <<EOF
|
|
disk: {
|
|
"pdev_path": "",
|
|
"vdev": "hdc",
|
|
"format": "empty",
|
|
"removable": 1,
|
|
"is_cdrom": 1
|
|
}
|
|
|
|
EOF
|
|
one 0 devtype=cdrom,,,hdc
|
|
one 0 ,,hdc:cdrom,r
|
|
one 0 ,hdc:cdrom,r
|
|
one 0 vdev=hdc,access=r,devtype=cdrom,target=
|
|
one 0 ,empty,hdc:cdrom,r
|
|
|
|
expected <<EOF
|
|
disk: {
|
|
"vdev": "hdc",
|
|
"format": "empty",
|
|
"removable": 1,
|
|
"is_cdrom": 1
|
|
}
|
|
|
|
EOF
|
|
one 0 vdev=hdc,access=r,devtype=cdrom,format=empty
|
|
one 0 vdev=hdc,access=r,devtype=cdrom
|
|
|
|
expected <<EOF
|
|
disk: {
|
|
"pdev_path": "iqn.2001-05.com.equallogic:0-8a0906-23fe93404-c82797962054a96d-examplehost",
|
|
"vdev": "xvda",
|
|
"format": "raw",
|
|
"script": "block-iscsi",
|
|
"readwrite": 1
|
|
}
|
|
|
|
EOF
|
|
|
|
# http://backdrift.org/xen-block-iscsi-script-with-multipath-support
|
|
one 0 iscsi:iqn.2001-05.com.equallogic:0-8a0906-23fe93404-c82797962054a96d-examplehost,xvda,w
|
|
one 0 vdev=xvda,access=w,script=block-iscsi,target=iqn.2001-05.com.equallogic:0-8a0906-23fe93404-c82797962054a96d-examplehost
|
|
|
|
expected <<EOF
|
|
disk: {
|
|
"pdev_path": "app01",
|
|
"vdev": "hda",
|
|
"format": "raw",
|
|
"script": "block-drbd",
|
|
"readwrite": 1
|
|
}
|
|
|
|
EOF
|
|
|
|
# http://lists.linbit.com/pipermail/drbd-user/2008-September/010221.html
|
|
# http://www.drbd.org/users-guide-emb/s-xen-configure-domu.html
|
|
one 0 drbd:app01,hda,w
|
|
|
|
expected <<END
|
|
disk: {
|
|
"pdev_path": "/some/disk/image.raw",
|
|
"vdev": "hda",
|
|
"format": "raw",
|
|
"readwrite": 1,
|
|
"discard_enable": "True"
|
|
}
|
|
|
|
END
|
|
one 0 discard vdev=hda target=/some/disk/image.raw
|
|
one 0 discard vdev=hda target=/some/disk/image.raw
|
|
|
|
expected <<END
|
|
disk: {
|
|
"pdev_path": "/some/disk/image.iso",
|
|
"vdev": "hda",
|
|
"format": "raw",
|
|
"removable": 1,
|
|
"is_cdrom": 1,
|
|
"discard_enable": "False"
|
|
}
|
|
|
|
END
|
|
one 0 cdrom no-discard vdev=hda target=/some/disk/image.iso
|
|
|
|
# test setting trusted
|
|
expected <<END
|
|
disk: {
|
|
"pdev_path": "/some/disk/image.raw",
|
|
"vdev": "hda",
|
|
"format": "raw",
|
|
"readwrite": 1,
|
|
"trusted": "True"
|
|
}
|
|
|
|
END
|
|
one 0 trusted vdev=hda target=/some/disk/image.raw
|
|
|
|
# test setting untrusted
|
|
expected <<END
|
|
disk: {
|
|
"pdev_path": "/some/disk/image.raw",
|
|
"vdev": "hda",
|
|
"format": "raw",
|
|
"readwrite": 1,
|
|
"trusted": "False"
|
|
}
|
|
|
|
END
|
|
one 0 untrusted vdev=hda target=/some/disk/image.raw
|
|
|
|
complete
|