tools/libxl: report trusted backend status to frontends

Allow administrators to notify a frontend driver that it's backend
counterpart is not to be trusted, so the frontend can deploy whatever
mitigations required in order to secure itself.

Allow such option for disk and network frontends only, as those are
the only hardened ones currently supported.

This is part of XSA-403

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Anthony PERARD <anthony.perard@citrix.com>

diff --git a/docs/man/xl-disk-configuration.5.pod.in b/docs/man/xl-disk-configuration.5.pod.in
index 71d0e86e3d63791850d0eab71864827463e125cf..95d039655a1edc312c4c9d3b7bc653c014995a6d 100644 (file)
--- a/docs/man/xl-disk-configuration.5.pod.in
+++ b/docs/man/xl-disk-configuration.5.pod.in
@@ -344,6 +344,35 @@ can be used to disable "hole punching" for file based backends which
 were intentionally created non-sparse to avoid fragmentation of the
 file.
 
+=item B<trusted> / B<untrusted>
+
+=over 4
+
+=item Description
+
+Reports whether the backend should be trusted by the frontend
+
+=item Supported values
+
+trusted, untrusted
+
+=item Mandatory
+
+No
+
+=item Default value
+
+trusted
+
+=back
+
+An advisory setting for the frontend driver on whether the backend should be
+trusted.  The frontend should deploy whatever protections it has available to
+prevent an untrusted backend from accessing guest data not related to the I/O
+processing or causing malfunction to the frontend or the whole domain.
+
+Note frontends can ignore such recommendation.
+
 =back
 
 

diff --git a/docs/man/xl-network-configuration.5.pod.in b/docs/man/xl-network-configuration.5.pod.in
index cf92d7960c63e3e6801618cc114a8603726629fe..f3e379bcf860237234c26c0a44a409381a16e09e 100644 (file)
--- a/docs/man/xl-network-configuration.5.pod.in
+++ b/docs/man/xl-network-configuration.5.pod.in
@@ -258,3 +258,12 @@ NOTE: This should not be set unless you have a reason to.
 Specifies the MTU (i.e. the maximum size of an IP payload, exclusing headers). The
 default value is 1500 but, if the VIF is attached to a bridge, it will be set to match
 unless overridden by this parameter.
+
+=head2 trusted / untrusted
+
+An advisory setting for the frontend driver on whether the backend should be
+trusted.  The frontend should deploy whatever protections it has available to
+prevent an untrusted backend from accessing guest data not related to the I/O
+processing or causing malfunction to the frontend or the whole domain.
+
+Note frontends can ignore such recommendation.

diff --git a/tools/include/libxl.h b/tools/include/libxl.h
index 7ce978e83c9ad552dac7860b11ea0c46b6145403..835dfabc50c71b3f240be0fcd024b70f7455b513 100644 (file)
--- a/tools/include/libxl.h
+++ b/tools/include/libxl.h
@@ -527,6 +527,14 @@
  */
 #define LIBXL_HAVE_MAX_GRANT_VERSION 1
 
+/*
+ * LIBXL_HAVE_{DISK,NIC}_TRUSTED indicates that the libxl_device_disk and
+ * libxl_device_nic structs have a field to signal whether the backend of the
+ * device is to be trusted.  Such information is propagated to the frontend.
+ */
+#define LIBXL_HAVE_DISK_TRUSTED 1
+#define LIBXL_HAVE_NIC_TRUSTED 1
+
 /*
  * libxl ABI compatibility
  *

diff --git a/tools/libs/light/libxl_disk.c b/tools/libs/light/libxl_disk.c
index a5ca77850f630b0fa9792ec50873e9c4c1721d68..9da2b2ed27d31b2be0bf11ceda489f7954afe19a 100644 (file)
--- a/tools/libs/light/libxl_disk.c
+++ b/tools/libs/light/libxl_disk.c
@@ -159,6 +159,7 @@ static int libxl__device_disk_setdefault(libxl__gc *gc, uint32_t domid,
     libxl_defbool_setdefault(&disk->discard_enable, !!disk->readwrite);
     libxl_defbool_setdefault(&disk->colo_enable, false);
     libxl_defbool_setdefault(&disk->colo_restore_enable, false);
+    libxl_defbool_setdefault(&disk->trusted, true);
 
     rc = libxl__resolve_domid(gc, disk->backend_domname, &disk->backend_domid);
     if (rc < 0) return rc;
@@ -395,6 +396,8 @@ static void device_disk_add(libxl__egc *egc, uint32_t domid,
         flexarray_append(front, GCSPRINTF("%d", device->devid));
         flexarray_append(front, "device-type");
         flexarray_append(front, disk->is_cdrom ? "cdrom" : "disk");
+        flexarray_append(front, "trusted");
+        flexarray_append(front, libxl_defbool_val(disk->trusted) ? "1" : "0");
 
         /*
          * Old PV kernel disk frontends before 2.6.26 rely on tool stack to

diff --git a/tools/libs/light/libxl_nic.c b/tools/libs/light/libxl_nic.c
index 0b9e70c9d13da0c8f0c7974b441ed9f4d659b2a5..d6bf06fc34069424e41fb6d07af965280d7a40e1 100644 (file)
--- a/tools/libs/light/libxl_nic.c
+++ b/tools/libs/light/libxl_nic.c
@@ -116,6 +116,8 @@ static int libxl__device_nic_setdefault(libxl__gc *gc, uint32_t domid,
         abort();
     }
 
+    libxl_defbool_setdefault(&nic->trusted, true);
+
     return rc;
 }
 
@@ -255,6 +257,9 @@ static int libxl__set_xenstore_nic(libxl__gc *gc, uint32_t domid,
     flexarray_append(back, "hotplug-status");
     flexarray_append(back, "");
 
+    flexarray_append(front, "trusted");
+    flexarray_append(front, libxl_defbool_val(nic->trusted) ? "1" : "0");
+
     return 0;
 }
 

diff --git a/tools/libs/light/libxl_types.idl b/tools/libs/light/libxl_types.idl
index 2a42da2f7d7808b6fc4cb8e6ae7839590e29649f..89962218b453ec772f6bc7a763f24f9d24f26916 100644 (file)
--- a/tools/libs/light/libxl_types.idl
+++ b/tools/libs/light/libxl_types.idl
@@ -712,7 +712,8 @@ libxl_device_disk = Struct("device_disk", [
     ("colo_port", integer),
     ("colo_export", string),
     ("active_disk", string),
-    ("hidden_disk", string)
+    ("hidden_disk", string),
+    ("trusted", libxl_defbool),
     ])
 
 libxl_device_nic = Struct("device_nic", [
@@ -780,7 +781,8 @@ libxl_device_nic = Struct("device_nic", [
     ("colo_filter_sec_redirector1_outdev", string),
     ("colo_filter_sec_rewriter0_queue", string),
     ("colo_checkpoint_host", string),
-    ("colo_checkpoint_port", string)
+    ("colo_checkpoint_port", string),
+    ("trusted", libxl_defbool),
     ])
 
 libxl_device_pci = Struct("device_pci", [

diff --git a/tools/libs/util/libxlu_disk_l.l b/tools/libs/util/libxlu_disk_l.l
index 3bd639aab0457acd9fa313c31258f905724c9951..e115460d99fa94d2ee8ee3c9ef7fd49a12e565be 100644 (file)
--- a/tools/libs/util/libxlu_disk_l.l
+++ b/tools/libs/util/libxlu_disk_l.l
@@ -208,6 +208,9 @@ colo-export=[^,]*,? { STRIP(','); SAVESTRING("colo-export", colo_export, FROMEQU
 active-disk=[^,]*,?    { STRIP(','); SAVESTRING("active-disk", active_disk, FROMEQUALS); }
 hidden-disk=[^,]*,?    { STRIP(','); SAVESTRING("hidden-disk", hidden_disk, FROMEQUALS); }
 
+trusted,?              { libxl_defbool_set(&DPC->disk->trusted, true); }
+untrusted,?            { libxl_defbool_set(&DPC->disk->trusted, false); }
+
  /* the target magic parameter, eats the rest of the string */
 
 target=.*      { STRIP(','); SAVESTRING("target", pdev_path, FROMEQUALS); }

diff --git a/tools/xl/check-xl-disk-parse b/tools/xl/check-xl-disk-parse
index 643f4f4ecb89ce3d58148e50e6da91017ac7bc1a..18fb66940a5464d17a89d41fa5fa9c051c5c2606 100755 (executable)
--- a/tools/xl/check-xl-disk-parse
+++ b/tools/xl/check-xl-disk-parse
@@ -178,4 +178,30 @@ disk: {
 END
 one 0  cdrom no-discard vdev=hda target=/some/disk/image.iso
 
+# test setting trusted
+expected <<END
+disk: {
+    "pdev_path": "/some/disk/image.raw",
+    "vdev": "hda",
+    "format": "raw",
+    "readwrite": 1,
+    "trusted": "True"
+}
+
+END
+one 0  trusted vdev=hda target=/some/disk/image.raw
+
+# test setting untrusted
+expected <<END
+disk: {
+    "pdev_path": "/some/disk/image.raw",
+    "vdev": "hda",
+    "format": "raw",
+    "readwrite": 1,
+    "trusted": "False"
+}
+
+END
+one 0  untrusted vdev=hda target=/some/disk/image.raw
+
 complete

diff --git a/tools/xl/check-xl-vif-parse b/tools/xl/check-xl-vif-parse
index 04bd9463d860ee919062882805ed199f737c9d79..d666408d4d121f1e40670d0f2d64a034a8c424a8 100755 (executable)
--- a/tools/xl/check-xl-vif-parse
+++ b/tools/xl/check-xl-vif-parse
@@ -160,4 +160,22 @@ one $e rate=4296MB/s@4294s
 expected </dev/null
 one $e rate=@
 
+# test trusted setting
+expected <<END
+vif: {
+    "trusted": "True"
+}
+
+END
+one 0 trusted
+
+# test untrusted setting
+expected <<END
+vif: {
+    "trusted": "False"
+}
+
+END
+one 0 untrusted
+
 complete

diff --git a/tools/xl/xl_parse.c b/tools/xl/xl_parse.c
index b98c0de378b6d51b4a9398e0f3dc930727b93051..644ab8f8fd3646244fb20784b65fc3323962072a 100644 (file)
--- a/tools/xl/xl_parse.c
+++ b/tools/xl/xl_parse.c
@@ -565,6 +565,10 @@ int parse_nic_config(libxl_device_nic *nic, XLU_Config **config, char *token)
         nic->devid = parse_ulong(oparg);
     } else if (MATCH_OPTION("mtu", token, oparg)) {
         nic->mtu = parse_ulong(oparg);
+    } else if (!strcmp("trusted", token)) {
+        libxl_defbool_set(&nic->trusted, true);
+    } else if (!strcmp("untrusted", token)) {
+        libxl_defbool_set(&nic->trusted, false);
     } else {
         fprintf(stderr, "unrecognized argument `%s'\n", token);
         return 1;

diff --git a/xen/include/public/io/blkif.h b/xen/include/public/io/blkif.h
index 4cdba79abaeb4244ffefe9f457359af9f8c9c7b0..ab863f175a4dd98d18e2d3e9a4f18a483fd107a7 100644 (file)
--- a/xen/include/public/io/blkif.h
+++ b/xen/include/public/io/blkif.h
@@ -363,6 +363,14 @@
  *      that the frontend requires that the logical block size is 512 as it
  *      is hardcoded (which is the case in some frontend implementations).
  *
+ * trusted
+ *      Values:         0/1 (boolean)
+ *      Default value:  1
+ *
+ *      A value of "0" indicates that the frontend should not trust the
+ *      backend, and should deploy whatever measures available to protect from
+ *      a malicious backend on the other end.
+ *
  *------------------------- Virtual Device Properties -------------------------
  *
  * device-type

diff --git a/xen/include/public/io/netif.h b/xen/include/public/io/netif.h
index 00dd258712f06ac23cf3260a75cddaeeeb217c60..3509b096f820404d4688763b422b7a8c228fa1a4 100644 (file)
--- a/xen/include/public/io/netif.h
+++ b/xen/include/public/io/netif.h
@@ -160,6 +160,12 @@
  * be applied if it is set.
  */
 
+/*
+ * The setting of "trusted" node to "0" in the frontend path signals that the
+ * frontend should not trust the backend, and should deploy whatever measures
+ * available to protect from a malicious backend on the other end.
+ */
+
 /*
  * Control ring
  * ============