* [pve-devel] [PATCH guest-common] fix #6130: remote migration: untaint bandwidth limit from remote
@ 2025-02-10 13:56 Fiona Ebner
2025-02-10 15:52 ` [pve-devel] applied: " Thomas Lamprecht
0 siblings, 1 reply; 2+ messages in thread
From: Fiona Ebner @ 2025-02-10 13:56 UTC (permalink / raw)
To: pve-devel
Remote migration via API will be invoked under Perl's '-T' switch to
detect tainted input used in commands. For remote migration, the
bandwidth limit from the remote side would be such tainted input. This
would lead to failure for offline disk migration when the target
node's bandwidth limit is stricter when invoking the 'pvesm export'
command:
> command 'set -o pipefail && pvesm export rbd:vm-400-disk-0 \
> raw+size - -with-snapshots 0 | /usr/bin/cstream -t 307232768' \
> failed: Insecure dependency in exec while running with -T switch
Untaint the value to fix the issue. Note that the schema for the
bandwidth limits in datacenter.cfg and storage.cfg allows fractional
values.
Avoid re-using the same variable for both, the reply from the remote
(which is a hash) and the actual remote bandwidth limit. This also
makes it possible to use the "assign regex match or die" pattern while
accessing the original value in the error message.
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
src/PVE/AbstractMigrate.pm | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/src/PVE/AbstractMigrate.pm b/src/PVE/AbstractMigrate.pm
index c337bcf..54f7956 100644
--- a/src/PVE/AbstractMigrate.pm
+++ b/src/PVE/AbstractMigrate.pm
@@ -350,9 +350,14 @@ sub get_bwlimit {
storages => [$target],
bwlimit => $self->{opts}->{bwlimit},
};
- my $remote_bwlimit = PVE::Tunnel::write_tunnel($self->{tunnel}, 10, 'bwlimit', $bwlimit_opts);
- if ($remote_bwlimit && $remote_bwlimit->{bwlimit}) {
- $remote_bwlimit = $remote_bwlimit->{bwlimit};
+
+ my $bwlimit_reply = PVE::Tunnel::write_tunnel(
+ $self->{tunnel}, 10, 'bwlimit', $bwlimit_opts);
+
+ if ($bwlimit_reply && $bwlimit_reply->{bwlimit}) {
+ # untaint
+ my ($remote_bwlimit) = ($bwlimit_reply->{bwlimit} =~ m/^(\d+(.\d+)?)$/)
+ or die "invalid remote bandwidth limit: '$bwlimit_reply->{bwlimit}'\n";
$bwlimit = $remote_bwlimit
if (!$bwlimit || $bwlimit > $remote_bwlimit);
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 2+ messages in thread
* [pve-devel] applied: [PATCH guest-common] fix #6130: remote migration: untaint bandwidth limit from remote
2025-02-10 13:56 [pve-devel] [PATCH guest-common] fix #6130: remote migration: untaint bandwidth limit from remote Fiona Ebner
@ 2025-02-10 15:52 ` Thomas Lamprecht
0 siblings, 0 replies; 2+ messages in thread
From: Thomas Lamprecht @ 2025-02-10 15:52 UTC (permalink / raw)
To: Proxmox VE development discussion, Fiona Ebner
Am 10.02.25 um 14:56 schrieb Fiona Ebner:
> Remote migration via API will be invoked under Perl's '-T' switch to
> detect tainted input used in commands. For remote migration, the
> bandwidth limit from the remote side would be such tainted input. This
> would lead to failure for offline disk migration when the target
> node's bandwidth limit is stricter when invoking the 'pvesm export'
> command:
>
>> command 'set -o pipefail && pvesm export rbd:vm-400-disk-0 \
>> raw+size - -with-snapshots 0 | /usr/bin/cstream -t 307232768' \
>> failed: Insecure dependency in exec while running with -T switch
>
> Untaint the value to fix the issue. Note that the schema for the
> bandwidth limits in datacenter.cfg and storage.cfg allows fractional
> values.
>
> Avoid re-using the same variable for both, the reply from the remote
> (which is a hash) and the actual remote bandwidth limit. This also
> makes it possible to use the "assign regex match or die" pattern while
> accessing the original value in the error message.
>
> Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
> ---
> src/PVE/AbstractMigrate.pm | 11 ++++++++---
> 1 file changed, 8 insertions(+), 3 deletions(-)
>
>
applied, thanks!
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-02-10 15:53 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-02-10 13:56 [pve-devel] [PATCH guest-common] fix #6130: remote migration: untaint bandwidth limit from remote Fiona Ebner
2025-02-10 15:52 ` [pve-devel] applied: " Thomas Lamprecht
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal