[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 03/49] char: don't assume telnet initialization will
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PULL 03/49] char: don't assume telnet initialization will not block |
Date: |
Tue, 26 Jan 2016 14:46:35 +0100 |
From: "Daniel P. Berrange" <address@hidden>
The current code for doing telnet initialization is writing to
a socket without checking the return status. While it is highly
unlikely to be a problem when writing to a bare socket, as the
buffers are large enough to prevent blocking, this cannot be
assumed safe with TLS sockets. So write the telnet initialization
code into a memory buffer and then use an I/O watch to fully
send the data.
Signed-off-by: Daniel P. Berrange <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
qemu-char.c | 87 ++++++++++++++++++++++++++++++++++++++++++++++++-------------
1 file changed, 69 insertions(+), 18 deletions(-)
diff --git a/qemu-char.c b/qemu-char.c
index 8e9156a..f0cea8a 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -2877,19 +2877,70 @@ static void tcp_chr_update_read_handler(CharDriverState
*chr)
}
}
-#define IACSET(x,a,b,c) x[0] = a; x[1] = b; x[2] = c;
-static void tcp_chr_telnet_init(QIOChannel *ioc)
+typedef struct {
+ CharDriverState *chr;
+ char buf[12];
+ size_t buflen;
+} TCPCharDriverTelnetInit;
+
+static gboolean tcp_chr_telnet_init_io(QIOChannel *ioc,
+ GIOCondition cond G_GNUC_UNUSED,
+ gpointer user_data)
+{
+ TCPCharDriverTelnetInit *init = user_data;
+ ssize_t ret;
+
+ ret = qio_channel_write(ioc, init->buf, init->buflen, NULL);
+ if (ret < 0) {
+ if (ret == QIO_CHANNEL_ERR_BLOCK) {
+ ret = 0;
+ } else {
+ tcp_chr_disconnect(init->chr);
+ return FALSE;
+ }
+ }
+ init->buflen -= ret;
+
+ if (init->buflen == 0) {
+ tcp_chr_connect(init->chr);
+ return FALSE;
+ }
+
+ memmove(init->buf, init->buf + ret, init->buflen);
+
+ return TRUE;
+}
+
+static void tcp_chr_telnet_init(CharDriverState *chr)
{
- char buf[3];
- /* Send the telnet negotion to put telnet in binary, no echo, single char
mode */
- IACSET(buf, 0xff, 0xfb, 0x01); /* IAC WILL ECHO */
- qio_channel_write(ioc, buf, 3, NULL);
- IACSET(buf, 0xff, 0xfb, 0x03); /* IAC WILL Suppress go ahead */
- qio_channel_write(ioc, buf, 3, NULL);
- IACSET(buf, 0xff, 0xfb, 0x00); /* IAC WILL Binary */
- qio_channel_write(ioc, buf, 3, NULL);
- IACSET(buf, 0xff, 0xfd, 0x00); /* IAC DO Binary */
- qio_channel_write(ioc, buf, 3, NULL);
+ TCPCharDriver *s = chr->opaque;
+ TCPCharDriverTelnetInit *init =
+ g_new0(TCPCharDriverTelnetInit, 1);
+ size_t n = 0;
+
+ init->chr = chr;
+ init->buflen = 12;
+
+#define IACSET(x, a, b, c) \
+ do { \
+ x[n++] = a; \
+ x[n++] = b; \
+ x[n++] = c; \
+ } while (0)
+
+ /* Prep the telnet negotion to put telnet in binary,
+ * no echo, single char mode */
+ IACSET(init->buf, 0xff, 0xfb, 0x01); /* IAC WILL ECHO */
+ IACSET(init->buf, 0xff, 0xfb, 0x03); /* IAC WILL Suppress go ahead */
+ IACSET(init->buf, 0xff, 0xfb, 0x00); /* IAC WILL Binary */
+ IACSET(init->buf, 0xff, 0xfd, 0x00); /* IAC DO Binary */
+
+#undef IACSET
+
+ qio_channel_add_watch(
+ s->ioc, G_IO_OUT,
+ tcp_chr_telnet_init_io,
+ init, NULL);
}
static int tcp_chr_new_client(CharDriverState *chr, QIOChannelSocket *sioc)
@@ -2909,7 +2960,12 @@ static int tcp_chr_new_client(CharDriverState *chr,
QIOChannelSocket *sioc)
g_source_remove(s->listen_tag);
s->listen_tag = 0;
}
- tcp_chr_connect(chr);
+
+ if (s->do_telnetopt) {
+ tcp_chr_telnet_init(chr);
+ } else {
+ tcp_chr_connect(chr);
+ }
return 0;
}
@@ -2935,7 +2991,6 @@ static gboolean tcp_chr_accept(QIOChannel *channel,
void *opaque)
{
CharDriverState *chr = opaque;
- TCPCharDriver *s = chr->opaque;
QIOChannelSocket *sioc;
sioc = qio_channel_socket_accept(QIO_CHANNEL_SOCKET(channel),
@@ -2944,10 +2999,6 @@ static gboolean tcp_chr_accept(QIOChannel *channel,
return TRUE;
}
- if (s->do_telnetopt) {
- tcp_chr_telnet_init(QIO_CHANNEL(sioc));
- }
-
tcp_chr_new_client(chr, sioc);
object_unref(OBJECT(sioc));
--
1.8.3.1
- [Qemu-devel] [PULL 00/49] chardev, NBD, cpus, scripts/ changes for 2015-01-26, Paolo Bonzini, 2016/01/26
- [Qemu-devel] [PULL 01/49] char: remove fixed length filename allocation, Paolo Bonzini, 2016/01/26
- [Qemu-devel] [PULL 04/49] char: introduce support for TLS encrypted TCP chardev backend, Paolo Bonzini, 2016/01/26
- [Qemu-devel] [PULL 02/49] char: convert from GIOChannel to QIOChannel, Paolo Bonzini, 2016/01/26
- [Qemu-devel] [PULL 03/49] char: don't assume telnet initialization will not block,
Paolo Bonzini <=
- [Qemu-devel] [PULL 06/49] qemu-char: avoid leak in qemu_chr_open_pp_fd, Paolo Bonzini, 2016/01/26
- [Qemu-devel] [PULL 08/49] scripts/kvm/kvm_stat: Replaced os.listdir with os.walk, Paolo Bonzini, 2016/01/26
- [Qemu-devel] [PULL 10/49] scripts/kvm/kvm_stat: Removed unneeded PERF constants, Paolo Bonzini, 2016/01/26
- [Qemu-devel] [PULL 05/49] docs: Style the command and its options in the synopsis, Paolo Bonzini, 2016/01/26
- [Qemu-devel] [PULL 07/49] scripts/kvm/kvm_stat: Cleanup of multiple imports, Paolo Bonzini, 2016/01/26
- [Qemu-devel] [PULL 09/49] scripts/kvm/kvm_stat: Make constants uppercase, Paolo Bonzini, 2016/01/26
- [Qemu-devel] [PULL 11/49] scripts/kvm/kvm_stat: Mark globals in functions, Paolo Bonzini, 2016/01/26
- [Qemu-devel] [PULL 13/49] scripts/kvm/kvm_stat: Cleanup of path variables, Paolo Bonzini, 2016/01/26
- [Qemu-devel] [PULL 12/49] scripts/kvm/kvm_stat: Invert dictionaries, Paolo Bonzini, 2016/01/26
- [Qemu-devel] [PULL 15/49] scripts/kvm/kvm_stat: Introduce main function, Paolo Bonzini, 2016/01/26