mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 10:11:27 +01:00
Edwin Török
bf0703992c
Currently, oxenstored checks the length of paths against 1024, then prepends "/local/domain/$DOMID/" to relative paths. This allows a domU to create paths which can't subsequently be read by anyone, even dom0. This also interferes with listing directories, etc. Define a new oxenstored.conf entry: quota-path-max, defaulting to 1024 as before. For paths that begin with "/local/domain/$DOMID/" check the relative path length against this quota. For all other paths check the entire path length. This ensures that if the domid changes (and thus the length of a prefix changes) a path that used to be valid stays valid (e.g. after a live-migration). It also ensures that regardless how the client tries to access a path (domid-relative or absolute) it will get consistent results, since the limit is always applied on the final canonicalized path. Delete the unused Domain.get_path to avoid it being confused with Connection.get_path (which differs by a trailing slash only). Rewrite Util.path_validate to apply the appropriate length restriction based on whether the path is relative or not. Remove the check for connection_path being absolute, because it is not guest controlled data. This is part of XSA-323. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Signed-off-by: Edwin Török <edvin.torok@citrix.com> Acked-by: Christian Lindig <christian.lindig@citrix.com>
54 lines
1.7 KiB
OCaml
54 lines
1.7 KiB
OCaml
(*
|
|
* Copyright (C) 2006-2007 XenSource Ltd.
|
|
* Copyright (C) 2008 Citrix Ltd.
|
|
* Author Vincent Hanquez <vincent.hanquez@eu.citrix.com>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU Lesser General Public License as published
|
|
* by the Free Software Foundation; version 2.1 only. with the special
|
|
* exception on linking described in file LICENSE.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU Lesser General Public License for more details.
|
|
*)
|
|
|
|
type pkt =
|
|
{
|
|
tid: int;
|
|
rid: int;
|
|
ty: Op.operation;
|
|
len: int;
|
|
buf: Buffer.t;
|
|
}
|
|
|
|
external header_size: unit -> int = "stub_header_size"
|
|
external header_of_string_internal: string -> int * int * int * int
|
|
= "stub_header_of_string"
|
|
|
|
let xenstore_payload_max = 4096 (* xen/include/public/io/xs_wire.h *)
|
|
let xenstore_rel_path_max = 2048 (* xen/include/public/io/xs_wire.h *)
|
|
|
|
let of_string s =
|
|
let tid, rid, opint, dlen = header_of_string_internal s in
|
|
(* A packet which is bigger than xenstore_payload_max is illegal.
|
|
This will leave the guest connection is a bad state and will
|
|
be hard to recover from without restarting the connection
|
|
(ie rebooting the guest) *)
|
|
let dlen = min xenstore_payload_max dlen in
|
|
{
|
|
tid = tid;
|
|
rid = rid;
|
|
ty = (Op.of_cval opint);
|
|
len = dlen;
|
|
buf = Buffer.create dlen;
|
|
}
|
|
|
|
let append pkt s sz =
|
|
if pkt.len > 4096 then failwith "Buffer.add: cannot grow buffer";
|
|
Buffer.add_string pkt.buf (String.sub s 0 sz)
|
|
|
|
let to_complete pkt =
|
|
pkt.len - (Buffer.length pkt.buf)
|