[acassen/keepalived] 329582: Use ipsets with namespaces on Linux < 3.13 if ipse...

Alexandre Cassen <[email protected]>
Newsgroups gmane.linux.keepalived.devel
Message-ID <5831c16e73bf2_11813fad695fb13428343@hookshot-fe3-cp1-prd.iad.github.net.mail> 
  Branch: refs/heads/master
  Home:   https://github.com/acassen/keepalived
  Commit: 329582eb39e27020a5a40cf02b3ca9aa9259c63f
      https://github.com/acassen/keepalived/commit/329582eb39e27020a5a40cf02b3ca9aa9259c63f
  Author: Quentin Armitage <[email protected]>
  Date:   2016-11-17 (Thu, 17 Nov 2016)

  Changed paths:
    A doc/README.sphinx
    M doc/keepalived.conf.SYNOPSIS
    M doc/man/man5/keepalived.conf.5
    M keepalived/vrrp/vrrp_daemon.c
    M keepalived/vrrp/vrrp_ipset.c

  Log Message:
  -----------
  Use ipsets with namespaces on Linux < 3.13 if ipset names configured

The problem with using ipsets with namespaces on Linux < 3.13 is that
ipsets were not namespace aware, and so all ipset entries added are
global to the system, including all network namespaces. This causes
problems if the default ipset names are used, but if set names have
been specified, it is reasonable that they have been set to be
different for each namespace, and hence there will be no clashes.

The documentation is also updated for vrrp_ipsets keyword.

Signed-off-by: Quentin Armitage <[email protected]>


  Commit: 9c7efa70c1f207061346ff9118cc82c70d2ac523
      https://github.com/acassen/keepalived/commit/9c7efa70c1f207061346ff9118cc82c70d2ac523
  Author: Quentin Armitage <[email protected]>
  Date:   2016-11-18 (Fri, 18 Nov 2016)

  Changed paths:
    M lib/memory.c
    M lib/memory.h
    M lib/notify.c

  Log Message:
  -----------
  Don't write MEM_CHECK data to log when forked script child terminates

The mem check log file was being filled with extraneous termination
information every time a forked child terminated. When a child is forked
it now sets a flag to stop the termination dump.

Signed-off-by: Quentin Armitage <[email protected]>


  Commit: 460a3abaadf86a67d2974dfce4b1db285aee1e0d
      https://github.com/acassen/keepalived/commit/460a3abaadf86a67d2974dfce4b1db285aee1e0d
  Author: Quentin Armitage <[email protected]>
  Date:   2016-11-19 (Sat, 19 Nov 2016)

  Changed paths:
    M configure
    M configure.ac

  Log Message:
  -----------
  Merge branch 'master' into fixes


  Commit: 991ac536ee504591f132063d5da2c9f332361f24
      https://github.com/acassen/keepalived/commit/991ac536ee504591f132063d5da2c9f332361f24
  Author: Quentin Armitage <[email protected]>
  Date:   2016-11-19 (Sat, 19 Nov 2016)

  Changed paths:
    M lib/notify.c

  Log Message:
  -----------
  Fix space/tab indentation in lib/notify.c

Signed-off-by: Quentin Armitage <[email protected]>


  Commit: b266fd95ee54e090196bc84938c7d7c17679509f
      https://github.com/acassen/keepalived/commit/b266fd95ee54e090196bc84938c7d7c17679509f
  Author: Quentin Armitage <[email protected]>
  Date:   2016-11-20 (Sun, 20 Nov 2016)

  Changed paths:
    M doc/keepalived.conf.SYNOPSIS
    M doc/man/man5/keepalived.conf.5
    M keepalived/check/check_data.c
    M keepalived/check/check_misc.c
    M keepalived/check/check_parser.c
    M keepalived/check/ipwrapper.c
    M keepalived/core/global_data.c
    M keepalived/core/global_parser.c
    M keepalived/core/main.c
    M keepalived/include/check_data.h
    M keepalived/include/check_misc.h
    M keepalived/include/global_data.h
    M keepalived/include/global_parser.h
    M keepalived/include/main.h
    M keepalived/include/vrrp.h
    M keepalived/include/vrrp_track.h
    M keepalived/vrrp/vrrp.c
    M keepalived/vrrp/vrrp_data.c
    M keepalived/vrrp/vrrp_notify.c
    M keepalived/vrrp/vrrp_parser.c
    M keepalived/vrrp/vrrp_print.c
    M keepalived/vrrp/vrrp_scheduler.c
    M lib/notify.c
    M lib/notify.h

  Log Message:
  -----------
  Make running scripts more secure

Previously, keepalived ran all scripts as root. This is potentially
dangerous if a non-root user can modify the script, or has write
access to any part of the path to the script.

This commit does the following:

1) Adds configuration options to specify the user/group under which to
   run each script

2) Adds an option to set the default script user/group. If this is not
   set it will default to user keepalived_script if that user exists,
   otherwise it will default to root, as before.

3) If a script is to be executed with root privilege, report if it is
   writeable in any way by a non-root user.

4) Add an option enable_script_security so that any scripts failing
   3) above won't be executed.

5) Report if any scripts are not executable by the relevant user.

Signed-off-by: Quentin Armitage <[email protected]>


  Commit: 224c8885b716a226249b1010a887447b6fc43e42
      https://github.com/acassen/keepalived/commit/224c8885b716a226249b1010a887447b6fc43e42
  Author: Quentin Armitage <[email protected]>
  Date:   2016-11-20 (Sun, 20 Nov 2016)

  Changed paths:
    M keepalived/check/ipvswrapper.c
    M keepalived/check/libipvs.c
    M keepalived/core/main.c
    M keepalived/include/check_data.h
    M keepalived/include/pidfile.h
    M keepalived/include/vrrp_iproute.h
    M keepalived/vrrp/vrrp.c
    M keepalived/vrrp/vrrp_data.c
    M keepalived/vrrp/vrrp_dbus.c
    M keepalived/vrrp/vrrp_ip_rule_route_parser.c
    M keepalived/vrrp/vrrp_ndisc.c
    M keepalived/vrrp/vrrp_netlink.c
    M keepalived/vrrp/vrrp_parser.c
    M keepalived/vrrp/vrrp_print.c
    M keepalived/vrrp/vrrp_snmp.c
    M lib/notify.c
    M lib/rttables.c
    M lib/scheduler.c

  Log Message:
  -----------
  Fix some lead tab/space issues

Signed-off-by: Quentin Armitage <[email protected]>


  Commit: 7cb32addfe670d81e29077776f3b98a37b7bcec9
      https://github.com/acassen/keepalived/commit/7cb32addfe670d81e29077776f3b98a37b7bcec9
  Author: Quentin Armitage <[email protected]>
  Date:   2016-11-20 (Sun, 20 Nov 2016)

  Changed paths:
    M lib/notify.h

  Log Message:
  -----------
  Fix segfault when terminating with no notify script configured

Signed-off-by: Quentin Armitage <[email protected]>


  Commit: dd772366d7dca3bc79c6354ddd001ac10c4e77e9
      https://github.com/acassen/keepalived/commit/dd772366d7dca3bc79c6354ddd001ac10c4e77e9
  Author: Quentin Armitage <[email protected]>
  Date:   2016-11-20 (Sun, 20 Nov 2016)

  Changed paths:
    M keepalived/vrrp/vrrp_netlink.c

  Log Message:
  -----------
  Fix compiler warning generated with --enable-conversion-checks

Signed-off-by: Quentin Armitage <[email protected]>


  Commit: d52fa0068affc3c6176ba5b5256904d6979fd308
      https://github.com/acassen/keepalived/commit/d52fa0068affc3c6176ba5b5256904d6979fd308
  Author: Quentin Armitage <[email protected]>
  Date:   2016-11-20 (Sun, 20 Nov 2016)

  Changed paths:
    M keepalived/include/vrrp_iptables.h
    M keepalived/vrrp/vrrp_daemon.c
    M keepalived/vrrp/vrrp_ipset.c
    M keepalived/vrrp/vrrp_iptables.c

  Log Message:
  -----------
  Don't segfault if modules ip_tables or ip6_tables not loaded

If either of the modules is not loaded, then don't use ip(6)tables for
that address family. We could load the module, but there would be no
entries pointing to the chains that we use, and so there is no point
adding entries to chains that won't be traversed.

This resolves issue #457

Signed-off-by: Quentin Armitage <[email protected]>


  Commit: bd2de73b427b2b78b703bef5c5e090619cdd49c0
      https://github.com/acassen/keepalived/commit/bd2de73b427b2b78b703bef5c5e090619cdd49c0
  Author: Quentin Armitage <[email protected]>
  Date:   2016-11-20 (Sun, 20 Nov 2016)

  Changed paths:
    M keepalived/check/ipwrapper.c
    M lib/parser.c

  Log Message:
  -----------
  Resolve some type mismatch warnings on 32 bit systems

Signed-off-by: Quentin Armitage <[email protected]>


  Commit: e4fa686270002db955995218fd1ae27d3bc252d0
      https://github.com/acassen/keepalived/commit/e4fa686270002db955995218fd1ae27d3bc252d0
  Author: Quentin Armitage <[email protected]>
  Date:   2016-11-20 (Sun, 20 Nov 2016)

  Changed paths:
    M keepalived/check/check_misc.c

  Log Message:
  -----------
  Fix checking security of misc_check scripts

Signed-off-by: Quentin Armitage <[email protected]>


  Commit: d1c830dc755f1c97eee61ee16f480d306f3bebfd
      https://github.com/acassen/keepalived/commit/d1c830dc755f1c97eee61ee16f480d306f3bebfd
  Author: Alexandre Cassen <[email protected]>
  Date:   2016-11-20 (Sun, 20 Nov 2016)

  Changed paths:
    A doc/README.sphinx
    M doc/keepalived.conf.SYNOPSIS
    M doc/man/man5/keepalived.conf.5
    M keepalived/check/check_data.c
    M keepalived/check/check_misc.c
    M keepalived/check/check_parser.c
    M keepalived/check/ipvswrapper.c
    M keepalived/check/ipwrapper.c
    M keepalived/check/libipvs.c
    M keepalived/core/global_data.c
    M keepalived/core/global_parser.c
    M keepalived/core/main.c
    M keepalived/include/check_data.h
    M keepalived/include/check_misc.h
    M keepalived/include/global_data.h
    M keepalived/include/global_parser.h
    M keepalived/include/main.h
    M keepalived/include/pidfile.h
    M keepalived/include/vrrp.h
    M keepalived/include/vrrp_iproute.h
    M keepalived/include/vrrp_iptables.h
    M keepalived/include/vrrp_track.h
    M keepalived/vrrp/vrrp.c
    M keepalived/vrrp/vrrp_daemon.c
    M keepalived/vrrp/vrrp_data.c
    M keepalived/vrrp/vrrp_dbus.c
    M keepalived/vrrp/vrrp_ip_rule_route_parser.c
    M keepalived/vrrp/vrrp_ipset.c
    M keepalived/vrrp/vrrp_iptables.c
    M keepalived/vrrp/vrrp_ndisc.c
    M keepalived/vrrp/vrrp_netlink.c
    M keepalived/vrrp/vrrp_notify.c
    M keepalived/vrrp/vrrp_parser.c
    M keepalived/vrrp/vrrp_print.c
    M keepalived/vrrp/vrrp_scheduler.c
    M keepalived/vrrp/vrrp_snmp.c
    M lib/memory.c
    M lib/memory.h
    M lib/notify.c
    M lib/notify.h
    M lib/parser.c
    M lib/rttables.c
    M lib/scheduler.c

  Log Message:
  -----------
  Merge pull request #458 from pqarmitage/fixes

Handle options for handling script execution securely


Compare: https://github.com/acassen/keepalived/compare/4106eeeb8fa6...d1c830dc755f

------------------------------------------------------------------------------

_______________________________________________
Keepalived-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/keepalived-devel
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.