[Xen-devel] [BUG] Fun with quoting

[Elliott Mitchell <ehem+xen@xxxxxxx>]

The man page for xf.cfg doesn't say much about strings in the Xen
configuration files, instead it simply says:

"STRING"

    A string, surrounded by either single or double quotes. But if the
  STRING is part of a SPEC_STRING, the quotes should be omitted.


Nothing about whether single-quotes have any effect different from
double-quotes or not.  This also says nothing of escape sequences for
inside those strings.  This is a problem because a few strings inside VM
configuration files can quite legitimately contain interesting
characters.

Of note on Unix a filename has almost no limitations.  Only the null
character is illegal in a filename, while backslashes and quotes are
quite legitimate.

So some things I tried with domain configuration files with the `xl` from
Xen 4.8.4.  This system has the Devuan Linux distribution, which is
mostly identical to Debian.  This is the section "disk".

'vdev=xvda,format=raw,access=rw,target=/dev/disk/by-partlabel/a\x2fstring'

Running `xl -N create -c xl.cfg`:
xl.cfg:45: config parsing error near 
`'vdev=xvda,format=raw,access=rw,target=/dev/disk/by-partlabel/a\x2fstring': 
invalid digit after backslash hexnumerical character escape in quoted string
Failed to parse config: Invalid argument

(return code 1)

Next: (trying for the hex value of a backslash)

'vdev=xvda,format=raw,access=rw,target=/dev/disk/by-partlabel/a\x5cx2fstring'

Resulted in the same error message.

Next:

'vdev=xvda,format=raw,access=rw,target=/dev/disk/by-partlabel/a\\x2fstring'

Running `xl -N create -c xl.cfg`, I've trimmed most of the output, what
I believe is the crucial portion is:

            "pdev_path": "/dev/disk/by-partlabel/a\\x2fstring",

Okay, looks legitimate.  Retry without the "-N" and:

libxl: error: libxl_exec.c:118:libxl_report_child_exitstatus: 
/etc/xen/scripts/block add [999] exited with error status 1


This was in fact caused by the /etc/xen/scripts/block script giving an
error.  Eventually I traced this down and the crucial command was
`xenstore-read "$XENBUS_PATH/params"` which was resulting in the string
"/dev/disk/by-partlabel/a\\x2fstring".

There seem to be inconsistencies in quoting of strings.  What I feel
should really have occured is for `xl`/libxl to translate the string into
"/dev/disk/by-partlabel/a\x2fstring", and then when outputting the data
due to the -N re-quoted it back to "/dev/disk/by-partlabel/a\\x2fstring".

I believe `xl -N` should have instead output:

            "pdev_path": "/dev/disk/by-partlabel/a\\\\x2fstring",

Since the internal string had both backslashes.

If you're wondering how I managed to do this, "a/string" is legitimate
for a slice label, this makes things easier in some ways and harder in
some ways.


-- 
(\___(\___(\______          --=> 8-) EHM <=--          ______/)___/)___/)
 \BS (    |         ehem+sigmsg@xxxxxxx  PGP 87145445         |    )   /
  \_CS\   |  _____  -O #include <stddisclaimer.h> O-   _____  |   /  _/
8A19\___\_|_/58D2 7E3D DDF4 7BA6 <-PGP-> 41D1 B375 37D0 8714\_|_/___/5445



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel