pbhenson / vSPC.py

a fork of vSPC.py, a virtual serial port concentrator for use with VMware
26 stars 24 forks source link

vMotion secret with IAC in it #22

Closed mbattersby closed 5 years ago

mbattersby commented 8 years ago

If the cookie sent to VMware by _handle_vmotion_begin contains an IAC (0xff) character then it will violate the telnet protocol.

Observed behavior is that VMware considered the secret sent with VMOTION_GOAHEAD to end at the IAC. It returns the truncated SEQUENCE+SECRET (cookie) in VMOTION_PEER, which vSPC.py rejects as not mapping to a known vMotion.

Minimal fix is to AND the cookie with something other than 0xFFFFFFFF so it can't contain an IAC. A better fix is probably to modify _send_vmware to escape IACs:

    def _send_vmware(self, s):
        s = s.replace(IAC, IAC+IAC)
        self.sock.sendall(IAC + SB + VMWARE_EXT + s + IAC + SE)

but I haven't tested if that (a) causes any other problems or (b) even makes it through correctly.

In any case hash(self) is a terrible way to make a random secret.

pbhenson commented 5 years ago

Hopefully fixed in master.