Proxmox/pve-guest-common
5
0
Fork 0
mirror of git://git.proxmox.com/git/pve-guest-common.git synced 2025-03-11 16:58:18 +03:00
Code Releases Activity

fix #6130: remote migration: untaint bandwidth limit from remote

Browse Source 
Remote migration via API will be invoked under Perl's '-T' switch to
detect tainted input used in commands. For remote migration, the
bandwidth limit from the remote side would be such tainted input. This
would lead to failure for offline disk migration when the target
node's bandwidth limit is stricter when invoking the 'pvesm export'
command:

> command 'set -o pipefail && pvesm export rbd:vm-400-disk-0 \
> raw+size - -with-snapshots 0 | /usr/bin/cstream -t 307232768' \
> failed: Insecure dependency in exec while running with -T switch

Untaint the value to fix the issue. Note that the schema for the
bandwidth limits in datacenter.cfg and storage.cfg allows fractional
values.

Avoid re-using the same variable for both, the reply from the remote
(which is a hash) and the actual remote bandwidth limit. This also
makes it possible to use the "assign regex match or die" pattern while
accessing the original value in the error message.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
This commit is contained in:
Fiona Ebner 2025-02-10 14:56:05 +01:00 committed by Thomas Lamprecht
parent 4c2dd7c226
commit 8d62b1e563
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/PVE/AbstractMigrate.pm
View File

@ -350,9 +350,14 @@ sub get_bwlimit {
storages => [$target], storages => [$target],
bwlimit => $self->{opts}->{bwlimit}, bwlimit => $self->{opts}->{bwlimit},
}; };
my $remote_bwlimit = PVE::Tunnel::write_tunnel($self->{tunnel}, 10, 'bwlimit', $bwlimit_opts);
if ($remote_bwlimit && $remote_bwlimit->{bwlimit}) { my $bwlimit_reply = PVE::Tunnel::write_tunnel(
$remote_bwlimit = $remote_bwlimit->{bwlimit}; $self->{tunnel}, 10, 'bwlimit', $bwlimit_opts);
if ($bwlimit_reply && $bwlimit_reply->{bwlimit}) {
# untaint
my ($remote_bwlimit) = ($bwlimit_reply->{bwlimit} =~ m/^(\d+(.\d+)?)$/)
or die "invalid remote bandwidth limit: '$bwlimit_reply->{bwlimit}'\n";
$bwlimit = $remote_bwlimit $bwlimit = $remote_bwlimit
if (!$bwlimit || $bwlimit > $remote_bwlimit); if (!$bwlimit || $bwlimit > $remote_bwlimit);