tools: Specify format of disks (RHBZ#642934,CVE-2010-3851).

Sys::Guestfs::Lib is changed in two ways: firstly we take the format
string from libvirt and pass it to add_drive_opts.  Secondly we allow
an extra format =>  parameter to open_guest which allows the
format to be specified for disk images.

All the tools are changed to add an extra --format parameter allowing
the format to be specified for direct disk images.

8 files changed, 157 insertions, 10 deletions

diff --git a/tools/virt-cat b/tools/virt-cat
index 67506c0b..66806a1a 100755
--- a/tools/virt-cat
+++ b/tools/virt-cat
@@ -109,6 +109,23 @@ connect to the default libvirt hypervisor.
 If you specify guest block devices directly, then libvirt is not used
 at all.
 
+=cut
+
+my $format;
+
+=item B<--format> raw
+
+Specify the format of disk images given on the command line.  If this
+is omitted then the format is autodetected from the content of the
+disk image.
+
+If disk images are requested from libvirt, then this program asks
+libvirt for this information.  In this case, the value of the format
+parameter is ignored.
+
+If working with untrusted raw-format guest disk images, you should
+ensure the format is always specified.
+
 =back
 
 =cut
@@ -116,6 +133,7 @@ at all.
 GetOptions ("help|?" => \$help,
             "version" => \$version,
             "connect|c=s" => \$uri,
+            "format=s" => \$format,
     ) or pod2usage (2);
 pod2usage (1) if $help;
 if ($version) {
@@ -132,9 +150,9 @@ my $filename = pop @ARGV;
 
 my $g;
 if ($uri) {
-    $g = open_guest (\@ARGV, address => $uri);
+    $g = open_guest (\@ARGV, address => $uri, format => $format);
 } else {
-    $g = open_guest (\@ARGV);
+    $g = open_guest (\@ARGV, format => $format);
 }
 
 $g->launch ();
diff --git a/tools/virt-edit b/tools/virt-edit
index 59b5b2b9..887ef4b6 100755
--- a/tools/virt-edit
+++ b/tools/virt-edit
@@ -120,6 +120,23 @@ at all.
 
 =cut
 
+my $format;
+
+=item B<--format> raw
+
+Specify the format of disk images given on the command line.  If this
+is omitted then the format is autodetected from the content of the
+disk image.
+
+If disk images are requested from libvirt, then this program asks
+libvirt for this information.  In this case, the value of the format
+parameter is ignored.
+
+If working with untrusted raw-format guest disk images, you should
+ensure the format is always specified.
+
+=cut
+
 my $expr;
 
 =item B<--expr EXPR> | B<-e EXPR>
@@ -138,6 +155,7 @@ being altered by the shell.
 GetOptions ("help|?" => \$help,
             "version" => \$version,
             "connect|c=s" => \$uri,
+            "format=s" => \$format,
             "expr|e=s" => \$expr,
             "backup|b=s" => \$backup,
     ) or pod2usage (2);
@@ -156,9 +174,9 @@ my $filename = pop @ARGV;
 
 my $g;
 if ($uri) {
-    $g = open_guest (\@ARGV, address => $uri, rw => 1);
+    $g = open_guest (\@ARGV, address => $uri, rw => 1, format => $format);
 } else {
-    $g = open_guest (\@ARGV, rw => 1);
+    $g = open_guest (\@ARGV, rw => 1, format => $format);
 }
 
 $g->launch ();
diff --git a/tools/virt-list-filesystems b/tools/virt-list-filesystems
index 7b4d5ad3..5f545cf0 100755
--- a/tools/virt-list-filesystems
+++ b/tools/virt-list-filesystems
@@ -81,6 +81,23 @@ at all.
 
 =cut
 
+my $format;
+
+=item B<--format> raw
+
+Specify the format of disk images given on the command line.  If this
+is omitted then the format is autodetected from the content of the
+disk image.
+
+If disk images are requested from libvirt, then this program asks
+libvirt for this information.  In this case, the value of the format
+parameter is ignored.
+
+If working with untrusted raw-format guest disk images, you should
+ensure the format is always specified.
+
+=cut
+
 my $long;
 
 =item B<-l> | B<--long>
@@ -107,6 +124,7 @@ Getopt::Long::Configure ("bundling");
 GetOptions ("help|?" => \$help,
             "version" => \$version,
             "connect|c=s" => \$uri,
+            "format=s" => \$format,
             "long|l" => \$long,
             "all|a" => \$all,
     ) or pod2usage (2);
@@ -123,9 +141,9 @@ pod2usage (__"virt-list-filesystems: no image or VM name given")
 
 my $g;
 if ($uri) {
-    $g = open_guest (\@ARGV, address => $uri);
+    $g = open_guest (\@ARGV, address => $uri, format => $format);
 } else {
-    $g = open_guest (\@ARGV);
+    $g = open_guest (\@ARGV, format => $format);
 }
 
 $g->launch ();
diff --git a/tools/virt-list-partitions b/tools/virt-list-partitions
index 0edecc4b..53059b48 100755
--- a/tools/virt-list-partitions
+++ b/tools/virt-list-partitions
@@ -82,6 +82,23 @@ at all.
 
 =cut
 
+my $format;
+
+=item B<--format> raw
+
+Specify the format of disk images given on the command line.  If this
+is omitted then the format is autodetected from the content of the
+disk image.
+
+If disk images are requested from libvirt, then this program asks
+libvirt for this information.  In this case, the value of the format
+parameter is ignored.
+
+If working with untrusted raw-format guest disk images, you should
+ensure the format is always specified.
+
+=cut
+
 my $human;
 
 =item B<-h> | B<--human-readable>
@@ -116,6 +133,7 @@ Getopt::Long::Configure ("bundling");
 GetOptions ("help|?" => \$help,
             "version" => \$version,
             "connect|c=s" => \$uri,
+            "format=s" => \$format,
             "human-readable|h" => \$human,
             "long|l" => \$long,
             "total|t" => \$total,
@@ -133,9 +151,9 @@ pod2usage (__"virt-list-partitions: no image or VM name given")
 
 my $g;
 if ($uri) {
-    $g = open_guest (\@ARGV, address => $uri);
+    $g = open_guest (\@ARGV, address => $uri, format => $format);
 } else {
-    $g = open_guest (\@ARGV);
+    $g = open_guest (\@ARGV, format => $format);
 }
 
 $g->launch ();
diff --git a/tools/virt-ls b/tools/virt-ls
index 9271a914..f0ac3f33 100755
--- a/tools/virt-ls
+++ b/tools/virt-ls
@@ -110,6 +110,23 @@ at all.
 
 =cut
 
+my $format;
+
+=item B<--format> raw
+
+Specify the format of disk images given on the command line.  If this
+is omitted then the format is autodetected from the content of the
+disk image.
+
+If disk images are requested from libvirt, then this program asks
+libvirt for this information.  In this case, the value of the format
+parameter is ignored.
+
+If working with untrusted raw-format guest disk images, you should
+ensure the format is always specified.
+
+=cut
+
 my $mode;
 
 =item B<-l> | B<--long>
@@ -147,6 +164,7 @@ sub set_mode_R
 GetOptions ("help|?" => \$help,
             "version" => \$version,
             "connect|c=s" => \$uri,
+            "format=s" => \$format,
             "long|l" => \&set_mode_l,
             "recursive|R" => \&set_mode_R,
     ) or pod2usage (2);
@@ -165,9 +183,9 @@ my $directory = pop @ARGV;
 
 my $g;
 if ($uri) {
-    $g = open_guest (\@ARGV, address => $uri);
+    $g = open_guest (\@ARGV, address => $uri, format => $format);
 } else {
-    $g = open_guest (\@ARGV);
+    $g = open_guest (\@ARGV, format => $format);
 }
 
 $g->launch ();
diff --git a/tools/virt-rescue b/tools/virt-rescue
index b8902a59..40245c76 100755
--- a/tools/virt-rescue
+++ b/tools/virt-rescue
@@ -142,6 +142,23 @@ at all.
 
 =cut
 
+my $format;
+
+=item B<--format> raw
+
+Specify the format of disk images given on the command line.  If this
+is omitted then the format is autodetected from the content of the
+disk image.
+
+If disk images are requested from libvirt, then this program asks
+libvirt for this information.  In this case, the value of the format
+parameter is ignored.
+
+If working with untrusted raw-format guest disk images, you should
+ensure the format is always specified.
+
+=cut
+
 my $memsize;
 
 =item B<--memsize MB> | B<-m MB>
@@ -180,6 +197,7 @@ GetOptions ("help|?" => \$help,
             "version" => \$version,
             "append=s" => \$append,
             "connect|c=s" => \$uri,
+            "format=s" => \$format,
             "memsize|m=i" => \$memsize,
             "ro|r" => \$readonly,
             "selinux" => \$selinux,
@@ -198,6 +216,7 @@ pod2usage (__"virt-rescue: no image or VM names rescue given")
 my @args = (\@ARGV);
 push @args, address => $uri if $uri;
 push @args, rw => 1 unless $readonly;
+push @args, format => $format if defined $format;
 my $g = open_guest (@args);
 
 # Setting "direct mode" is required for the rescue appliance.
diff --git a/tools/virt-tar b/tools/virt-tar
index 5e6e95a2..ea33fcf7 100755
--- a/tools/virt-tar
+++ b/tools/virt-tar
@@ -130,6 +130,23 @@ at all.
 
 =cut
 
+my $format;
+
+=item B<--format> raw
+
+Specify the format of disk images given on the command line.  If this
+is omitted then the format is autodetected from the content of the
+disk image.
+
+If disk images are requested from libvirt, then this program asks
+libvirt for this information.  In this case, the value of the format
+parameter is ignored.
+
+If working with untrusted raw-format guest disk images, you should
+ensure the format is always specified.
+
+=cut
+
 my $mode;
 
 =item B<-x> | B<--extract> | B<--download>
@@ -175,6 +192,7 @@ Getopt::Long::Configure ("bundling");
 GetOptions ("help|?" => \$help,
             "version" => \$version,
             "connect|c=s" => \$uri,
+            "format=s" => \$format,
             "extract|download|x" => \&set_mode_x,
             "upload|u" => \&set_mode_u,
             "gzip|z" => \$gzip,
@@ -211,6 +229,7 @@ die __x("virt-tar: {dir}: directory name must start with '/' character\n",
 my @args = (\@ARGV);
 push @args, address => $uri if $uri;
 push @args, rw => 1 if $mode eq "u";
+push @args, format => $format if defined $format;
 
 my $g = open_guest (@args);
 $g->launch ();
diff --git a/tools/virt-win-reg b/tools/virt-win-reg
index 16688f47..ed298fbc 100755
--- a/tools/virt-win-reg
+++ b/tools/virt-win-reg
@@ -211,6 +211,23 @@ at all.
 
 =cut
 
+my $format;
+
+=item B<--format> raw
+
+Specify the format of disk images given on the command line.  If this
+is omitted then the format is autodetected from the content of the
+disk image.
+
+If disk images are requested from libvirt, then this program asks
+libvirt for this information.  In this case, the value of the format
+parameter is ignored.
+
+If working with untrusted raw-format guest disk images, you should
+ensure the format is always specified.
+
+=cut
+
 my $merge;
 
 =item B<--merge>
@@ -244,6 +261,7 @@ GetOptions ("help|?" => \$help,
             "version" => \$version,
             "connect|c=s" => \$uri,
             "debug|d" => \$debug,
+            "format=s" => \$format,
             "merge" => \$merge,
             "encoding=s" => \$encoding,
     ) or pod2usage (2);
@@ -264,6 +282,7 @@ warn "launching libguestfs ..." if $debug;
 my @lib_args = ([$domname_or_image]);
 push @lib_args, address => $uri if $uri;
 push @lib_args, rw => 1 if $merge;
+push @lib_args, format => $format if defined $format;
 my $g = open_guest (@lib_args);
 $g->launch ();