public inbox for pve-devel@lists.proxmox.com
 help / color / mirror / Atom feed
* [pve-devel] [PATCH guest-common] fix #6130: remote migration: untaint bandwidth limit from remote
@ 2025-02-10 13:56 Fiona Ebner
  2025-02-10 15:52 ` [pve-devel] applied: " Thomas Lamprecht
  0 siblings, 1 reply; 2+ messages in thread
From: Fiona Ebner @ 2025-02-10 13:56 UTC (permalink / raw)
  To: pve-devel

Remote migration via API will be invoked under Perl's '-T' switch to
detect tainted input used in commands. For remote migration, the
bandwidth limit from the remote side would be such tainted input. This
would lead to failure for offline disk migration when the target
node's bandwidth limit is stricter when invoking the 'pvesm export'
command:

> command 'set -o pipefail && pvesm export rbd:vm-400-disk-0 \
> raw+size - -with-snapshots 0 | /usr/bin/cstream -t 307232768' \
> failed: Insecure dependency in exec while running with -T switch

Untaint the value to fix the issue. Note that the schema for the
bandwidth limits in datacenter.cfg and storage.cfg allows fractional
values.

Avoid re-using the same variable for both, the reply from the remote
(which is a hash) and the actual remote bandwidth limit. This also
makes it possible to use the "assign regex match or die" pattern while
accessing the original value in the error message.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
 src/PVE/AbstractMigrate.pm | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/src/PVE/AbstractMigrate.pm b/src/PVE/AbstractMigrate.pm
index c337bcf..54f7956 100644
--- a/src/PVE/AbstractMigrate.pm
+++ b/src/PVE/AbstractMigrate.pm
@@ -350,9 +350,14 @@ sub get_bwlimit {
 	    storages => [$target],
 	    bwlimit => $self->{opts}->{bwlimit},
 	};
-	my $remote_bwlimit = PVE::Tunnel::write_tunnel($self->{tunnel}, 10, 'bwlimit', $bwlimit_opts);
-	if ($remote_bwlimit && $remote_bwlimit->{bwlimit}) {
-	    $remote_bwlimit = $remote_bwlimit->{bwlimit};
+
+	my $bwlimit_reply = PVE::Tunnel::write_tunnel(
+	    $self->{tunnel}, 10, 'bwlimit', $bwlimit_opts);
+
+	if ($bwlimit_reply && $bwlimit_reply->{bwlimit}) {
+	    # untaint
+	    my ($remote_bwlimit) = ($bwlimit_reply->{bwlimit} =~ m/^(\d+(.\d+)?)$/)
+		or die "invalid remote bandwidth limit: '$bwlimit_reply->{bwlimit}'\n";
 
 	    $bwlimit = $remote_bwlimit
 		if (!$bwlimit || $bwlimit > $remote_bwlimit);
-- 
2.39.5



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2025-02-10 15:53 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-02-10 13:56 [pve-devel] [PATCH guest-common] fix #6130: remote migration: untaint bandwidth limit from remote Fiona Ebner
2025-02-10 15:52 ` [pve-devel] applied: " Thomas Lamprecht

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal