From 7f3d60df818fb2b1dd99b12f893a50fd2402968f Mon Sep 17 00:00:00 2001

From: Thomas Haller <thaller@redhat.com>

Date: Wed, 17 May 2017 16:45:46 +0200

Subject: [PATCH 01/13] libnm: fix unterminated NUL string when parsing UDev

 properties

This can result in trailing garbage (which fails UTF-8 validation

checks) or even worse, in read-out-of-bounds.

Fixes: 6808bf8195d427975638610781f8c5384228218d

https://bugzilla.redhat.com/show_bug.cgi?id=1443114

https://bugzilla.redhat.com/show_bug.cgi?id=1451160

https://bugzilla.redhat.com/show_bug.cgi?id=1451286

(cherry picked from commit 9594ee6e6921c3e37615a572de7e986274a68500)

(cherry picked from commit 5eb11aa8ec4e402b3e5795723519cdaab1cfb828)

---

 shared/nm-utils/nm-udev-utils.c | 1 +

 1 file changed, 1 insertion(+)

diff --git a/shared/nm-utils/nm-udev-utils.c b/shared/nm-utils/nm-udev-utils.c

index bf0ad5b..1f1811c 100644

--- a/shared/nm-utils/nm-udev-utils.c

+++ b/shared/nm-utils/nm-udev-utils.c

@@ -89,6 +89,7 @@ nm_udev_utils_property_decode (const char *uproperty, char **to_free)

 		return uproperty;

 	}

+	*n++ = '\0';

 	return (*to_free = unescaped);

 }

-- 

2.9.4

From be2a87e07f7a75e568d68afed1532b24edbee414 Mon Sep 17 00:00:00 2001

From: Thomas Haller <thaller@redhat.com>

Date: Wed, 17 May 2017 17:04:13 +0200

Subject: [PATCH 02/13] libnm: don't cunescape \x00 encoding in

 nm_udev_utils_property_decode()

UDev never creates such invalid escape sequences. Anyway,

we cannot accept a NUL character at this point. Just take

the ill escape verbatim -- it should never happen anyway.

(cherry picked from commit c15eae92c0c5fc12017dd84a66ee0bbb9638b270)

(cherry picked from commit 822282754d1653ac24f6e5a9bf616fc74f957050)

---

 shared/nm-utils/nm-udev-utils.c | 7 ++++---

 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/shared/nm-utils/nm-udev-utils.c b/shared/nm-utils/nm-udev-utils.c

index 1f1811c..79d4426 100644

--- a/shared/nm-utils/nm-udev-utils.c

+++ b/shared/nm-utils/nm-udev-utils.c

@@ -67,8 +67,9 @@ nm_udev_utils_property_decode (const char *uproperty, char **to_free)

 		if (   p[0] == '\\'

 		    && p[1] == 'x'

 		    && (a = g_ascii_xdigit_value (p[2])) >= 0

-		    && (b = g_ascii_xdigit_value (p[3])) >= 0) {

-			if (!unescaped) {

+		    && (b = g_ascii_xdigit_value (p[3])) >= 0

+		    && (a || b)) {

+			if (!n) {

 				gssize l = p - uproperty;

 				unescaped = g_malloc (l + strlen (p) + 1 - 3);

@@ -84,7 +85,7 @@ nm_udev_utils_property_decode (const char *uproperty, char **to_free)

 		}

 	}

-	if (!unescaped) {

+	if (!n) {

 		*to_free = NULL;

 		return uproperty;

 	}

-- 

2.9.4

From e1679a6a48ba7367528927f3e7f0021be71e37d6 Mon Sep 17 00:00:00 2001

From: Thomas Haller <thaller@redhat.com>

Date: Wed, 17 May 2017 15:18:20 +0200

Subject: [PATCH 03/13] device: fix setting device's UDI property

Fixes: e8139f56c26ae3bcc5e14abdb29970ae07e93299

(cherry picked from commit 5eac18b58d2be9b5b611f4b4e356b2ac59e46bce)

(cherry picked from commit 4ae14d3677609ef3c702c1a7a706b6bc38030958)

---

 src/devices/nm-device.c | 4 ++--

 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c

index b14dc49..62cb5dd 100644

--- a/src/devices/nm-device.c

+++ b/src/devices/nm-device.c

@@ -2460,7 +2460,7 @@ device_link_changed (NMDevice *self)

 	info = *pllink;

 	udi = nm_platform_link_get_udi (nm_device_get_platform (self), info.ifindex);

-	if (udi && g_strcmp0 (udi, priv->udi)) {

+	if (udi && !nm_streq0 (udi, priv->udi)) {

 		/* Update UDI to what udev gives us */

 		g_free (priv->udi);

 		priv->udi = g_strdup (udi);

@@ -2841,7 +2841,7 @@ update_device_from_platform_link (NMDevice *self, const NMPlatformLink *plink)

 	g_return_if_fail (plink != NULL);

 	udi = nm_platform_link_get_udi (nm_device_get_platform (self), plink->ifindex);

-	if (udi && !g_strcmp0 (udi, priv->udi)) {

+	if (udi && !nm_streq0 (udi, priv->udi)) {

 		g_free (priv->udi);

 		priv->udi = g_strdup (udi);

 		_notify (self, PROP_UDI);

-- 

2.9.4

From 84b1c78c2474d9e579955fa0ebdfc6a8c0761548 Mon Sep 17 00:00:00 2001

From: Thomas Haller <thaller@redhat.com>

Date: Wed, 17 May 2017 15:01:10 +0200

Subject: [PATCH 04/13] device: make UDI property construct-only

(cherry picked from commit e216d5eac0768b5936f3415cde7808982c74f0ac)

(cherry picked from commit c3b180198fe10d1fe84fea8b9944834be4f4ad56)

---

 src/devices/nm-device.c | 9 +++------

 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c

index 62cb5dd..ed9bc49 100644

--- a/src/devices/nm-device.c

+++ b/src/devices/nm-device.c

@@ -13894,14 +13894,11 @@ set_property (GObject *object, guint prop_id,

 	switch (prop_id) {

 	case PROP_UDI:

-		if (g_value_get_string (value)) {

-			g_free (priv->udi);

-			priv->udi = g_value_dup_string (value);

-		}

+		/* construct-only */

+		priv->udi = g_value_dup_string (value);

 		break;

 	case PROP_IFACE:

 		/* construct-only */

-		g_return_if_fail (!priv->iface);

 		priv->iface = g_value_dup_string (value);

 		break;

 	case PROP_DRIVER:

@@ -14212,7 +14209,7 @@ nm_device_class_init (NMDeviceClass *klass)

 	obj_properties[PROP_UDI] =

 	    g_param_spec_string (NM_DEVICE_UDI, "", "",

 	                         NULL,

-	                         G_PARAM_READWRITE | G_PARAM_CONSTRUCT |

+	                         G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY |

 	                         G_PARAM_STATIC_STRINGS);

 	obj_properties[PROP_IFACE] =

 	    g_param_spec_string (NM_DEVICE_IFACE, "", "",

-- 

2.9.4

From c63800b21cb46b7fbdc318205ed6af93aac9aeac Mon Sep 17 00:00:00 2001

From: Thomas Haller <thaller@redhat.com>

Date: Tue, 16 May 2017 18:50:21 +0200

Subject: [PATCH 05/13] shared: add nm_utils_str_utf8safe_*() API to sanitize

 UTF-8 strings

Use C-style backslash escaping to sanitize non-UTF-8 strings.

The functions are compatible with glib's g_strcompress() and

g_strescape().

The difference is only that g_strescape() escapes all non-printable,

non ASCII character as well, while nm_utils_str_utf8safe_escape()

-- depending on the flags -- preserves valid UTF-8 sequence except

backslash.

The flags allow to optionally escape ASCII control characters and

all non-ASCII (valid UTF-8) characters. But the option to preserve

valid UTF-8 (non-ASCII) characters verbatim, is what distinguishes

from g_strescape().

(cherry picked from commit df6d27b33a86e2ecdc5a8e1deff275d19b2cbde1)

(cherry picked from commit 52105f27df974715a8481fb240f98f73a6a8be08)

---

 libnm-core/tests/test-general.c   |  95 ++++++++++++++++++++++++++

 shared/nm-utils/nm-shared-utils.c | 138 ++++++++++++++++++++++++++++++++++++++

 shared/nm-utils/nm-shared-utils.h |  16 +++++

 3 files changed, 249 insertions(+)

diff --git a/libnm-core/tests/test-general.c b/libnm-core/tests/test-general.c

index 7ecd681..fbcfa7d 100644

--- a/libnm-core/tests/test-general.c

+++ b/libnm-core/tests/test-general.c

@@ -5248,6 +5248,100 @@ static void test_nm_utils_enum (void)

 /*****************************************************************************/

+static void

+do_test_utils_str_utf8safe (const char *str, const char *expected, NMUtilsStrUtf8SafeFlags flags)

+{

+	const char *str_safe, *s;

+	gs_free char *str2 = NULL;

+	gs_free char *str3 = NULL;

+

+	str_safe = nm_utils_str_utf8safe_escape (str, flags, &str2;;

+

+	str3 = nm_utils_str_utf8safe_escape_cp (str, flags);

+	g_assert_cmpstr (str3, ==, str_safe);

+	g_assert ((!str && !str3) || (str != str3));

+	g_clear_pointer (&str3, g_free);

+

+	if (expected == NULL) {

+		g_assert (str_safe == str);

+		g_assert (!str2);

+		if (str) {

+			g_assert (!strchr (str, '\\'));

+			g_assert (g_utf8_validate (str, -1, NULL));

+		}

+

+		g_assert (str == nm_utils_str_utf8safe_unescape (str_safe, &str3));

+		g_assert (!str3);

+

+		str3 = nm_utils_str_utf8safe_unescape_cp (str_safe);

+		if (str) {

+			g_assert (str3 != str);

+			g_assert_cmpstr (str3, ==, str);

+		} else

+			g_assert (!str3);

+		g_clear_pointer (&str3, g_free);

+		return;

+	}

+

+	g_assert (str);

+	g_assert (str_safe != str);

+	g_assert (str_safe == str2);

+	g_assert (   strchr (str, '\\')

+	          || !g_utf8_validate (str, -1, NULL)

+	          || (   NM_FLAGS_HAS (flags, NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_NON_ASCII)

+	              && NM_STRCHAR_ANY (str, ch, (guchar) ch >= 127))

+	          || (   NM_FLAGS_HAS (flags, NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL)

+	              && NM_STRCHAR_ANY (str, ch, (guchar) ch < ' ')));

+	g_assert (g_utf8_validate (str_safe, -1, NULL));

+

+	str3 = g_strcompress (str_safe);

+	g_assert_cmpstr (str, ==, str3);

+	g_clear_pointer (&str3, g_free);

+

+	str3 = nm_utils_str_utf8safe_unescape_cp (str_safe);

+	g_assert (str3 != str);

+	g_assert_cmpstr (str3, ==, str);

+	g_clear_pointer (&str3, g_free);

+

+	s = nm_utils_str_utf8safe_unescape (str_safe, &str3;;

+	g_assert (str3 != str);

+	g_assert (s == str3);

+	g_assert_cmpstr (str3, ==, str);

+	g_clear_pointer (&str3, g_free);

+

+	g_assert_cmpstr (str_safe, ==, expected);

+}

+

+static void

+test_utils_str_utf8safe (void)

+{

+	do_test_utils_str_utf8safe (NULL, NULL,                                       NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("", NULL,                                         NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("\314", "\\314",                                  NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("\314\315x\315\315x", "\\314\\315x\\315\\315x",   NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("\314\315xx", "\\314\\315xx",                     NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("\314xx", "\\314xx",                              NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("\xa0", "\\240",                                  NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("\xe2\x91\xa0", NULL,                             NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("\xe2\xe2\x91\xa0", "\\342\xe2\x91\xa0",          NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("\xe2\xe2\x91\xa0\xa0", "\\342\xe2\x91\xa0\\240", NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("a", NULL,                                        NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("ab", NULL,                                       NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("ab\314", "ab\\314",                              NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("ab\314adsf", "ab\\314adsf",                      NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("abadsf", NULL,                                   NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("abäb", NULL,                                     NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("x\xa0", "x\\240",                                NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("Ä\304ab\\äb", "Ä\\304ab\\\\äb",                  NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("Äab\\äb", "Äab\\\\äb",                           NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("ÄÄab\\äb", "ÄÄab\\\\äb",                         NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("㈞abä㈞b", NULL,                                 NM_UTILS_STR_UTF8_SAFE_FLAG_NONE);

+	do_test_utils_str_utf8safe ("abäb", "ab\\303\\244b",                          NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_NON_ASCII);

+	do_test_utils_str_utf8safe ("ab\ab", "ab\\007b",                              NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL);

+}

+

+/*****************************************************************************/

+

 static int

 _test_nm_in_set_get (int *call_counter, gboolean allow_called, int value)

 {

@@ -5605,6 +5699,7 @@ int main (int argc, char **argv)

 	nmtst_init (&argc, &argv, TRUE);

 	/* The tests */

+	g_test_add_func ("/core/general/test_utils_str_utf8safe", test_utils_str_utf8safe);

 	g_test_add_func ("/core/general/test_nm_in_set", test_nm_in_set);

 	g_test_add_func ("/core/general/test_nm_in_strset", test_nm_in_strset);

 	g_test_add_func ("/core/general/test_setting_vpn_items", test_setting_vpn_items);

diff --git a/shared/nm-utils/nm-shared-utils.c b/shared/nm-utils/nm-shared-utils.c

index 413526d..e7f31cb 100644

--- a/shared/nm-utils/nm-shared-utils.c

+++ b/shared/nm-utils/nm-shared-utils.c

@@ -364,3 +364,141 @@ nm_g_object_set_property (GObject *object,

 }

 /*****************************************************************************/

+

+static void

+_str_append_escape (GString *s, char ch)

+{

+	g_string_append_c (s, '\\');

+	g_string_append_c (s, '0' + ((((guchar) ch) >> 6) & 07));

+	g_string_append_c (s, '0' + ((((guchar) ch) >> 3) & 07));

+	g_string_append_c (s, '0' + ( ((guchar) ch)       & 07));

+}

+

+/**

+ * nm_utils_str_utf8safe_escape:

+ * @str: NUL terminated input string, possibly in utf-8 encoding

+ * @flags: #NMUtilsStrUtf8SafeFlags flags

+ * @to_free: (out): return the pointer location of the string

+ *   if a copying was necessary.

+ *

+ * Returns the possible non-UTF-8 NUL terminated string @str

+ * and uses backslash escaping (C escaping, like g_strescape())

+ * to sanitize non UTF-8 characters. The result is valid

+ * UTF-8.

+ *

+ * The operation can be reverted with g_strcompress() or

+ * nm_utils_str_utf8safe_unescape().

+ *

+ * Depending on @flags, valid UTF-8 characters are not escaped at all

+ * (except the escape character '\\'). This is the difference to g_strescape(),

+ * which escapes all non-ASCII characters. This allows to pass on

+ * valid UTF-8 characters as-is and can be directly shown to the user

+ * as UTF-8 -- with exception of the backslash escape character,

+ * invalid UTF-8 sequences, and other (depending on @flags).

+ *

+ * Returns: the escaped input string, as valid UTF-8. If no escaping

+ *   is necessary, it returns the input @str. Otherwise, an allocated

+ *   string @to_free is returned which must be freed by the caller

+ *   with g_free. The escaping can be reverted by g_strcompress().

+ **/

+const char *

+nm_utils_str_utf8safe_escape (const char *str, NMUtilsStrUtf8SafeFlags flags, char **to_free)

+{

+	const char *p = NULL;

+	GString *s;

+

+	g_return_val_if_fail (to_free, NULL);

+

+	*to_free = NULL;

+	if (!str || !str[0])

+		return str;

+

+	if (   g_utf8_validate (str, -1, &p)

+	    && !NM_STRCHAR_ANY (str, ch,

+	                        (   ch == '\\' \

+	                         || (   NM_FLAGS_HAS (flags, NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL) \

+	                             && ch < ' ') \

+	                         || (   NM_FLAGS_HAS (flags, NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_NON_ASCII) \

+	                             && ((guchar) ch) >= 127))))

+		return str;

+

+	s = g_string_sized_new ((p - str) + strlen (p) + 5);

+

+	do {

+		for (; str < p; str++) {

+			char ch = str[0];

+

+			if (ch == '\\')

+				g_string_append (s, "\\\\");

+			else if (   (   NM_FLAGS_HAS (flags, NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL) \

+			             && ch < ' ') \

+			         || (   NM_FLAGS_HAS (flags, NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_NON_ASCII) \

+			             && ((guchar) ch) >= 127))

+				_str_append_escape (s, ch);

+			else

+				g_string_append_c (s, ch);

+		}

+

+		if (p[0] == '\0')

+			break;

+		_str_append_escape (s, p[0]);

+

+		str = &p[1];

+		g_utf8_validate (str, -1, &p);

+	} while (TRUE);

+

+	*to_free = g_string_free (s, FALSE);

+	return *to_free;

+}

+

+const char *

+nm_utils_str_utf8safe_unescape (const char *str, char **to_free)

+{

+	g_return_val_if_fail (to_free, NULL);

+

+	if (!str || !strchr (str, '\\')) {

+		*to_free = NULL;

+		return str;

+	}

+	return (*to_free = g_strcompress (str));

+}

+

+/**

+ * nm_utils_str_utf8safe_escape_cp:

+ * @str: NUL terminated input string, possibly in utf-8 encoding

+ * @flags: #NMUtilsStrUtf8SafeFlags flags

+ *

+ * Like nm_utils_str_utf8safe_escape(), except the returned value

+ * is always a copy of the input and must be freed by the caller.

+ *

+ * Returns: the escaped input string in UTF-8 encoding. The returned

+ *   value should be freed with g_free().

+ *   The escaping can be reverted by g_strcompress().

+ **/

+char *

+nm_utils_str_utf8safe_escape_cp (const char *str, NMUtilsStrUtf8SafeFlags flags)

+{

+	char *s;

+

+	nm_utils_str_utf8safe_escape (str, flags, &s);

+	return s ?: g_strdup (str);

+}

+

+char *

+nm_utils_str_utf8safe_unescape_cp (const char *str)

+{

+	return str ? g_strcompress (str) : NULL;

+}

+

+char *

+nm_utils_str_utf8safe_escape_take (char *str, NMUtilsStrUtf8SafeFlags flags)

+{

+	char *str_to_free;

+

+	nm_utils_str_utf8safe_escape (str, flags, &str_to_free);

+	if (str_to_free) {

+		g_free (str);

+		return str_to_free;

+	}

+	return str;

+}

diff --git a/shared/nm-utils/nm-shared-utils.h b/shared/nm-utils/nm-shared-utils.h

index f1f9f51..69f9533 100644

--- a/shared/nm-utils/nm-shared-utils.h

+++ b/shared/nm-utils/nm-shared-utils.h

@@ -86,4 +86,20 @@ gboolean nm_g_object_set_property (GObject *object,

 /*****************************************************************************/

+typedef enum {

+	NM_UTILS_STR_UTF8_SAFE_FLAG_NONE                = 0,

+	NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL         = 0x0001,

+	NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_NON_ASCII    = 0x0002,

+} NMUtilsStrUtf8SafeFlags;

+

+const char *nm_utils_str_utf8safe_escape   (const char *str, NMUtilsStrUtf8SafeFlags flags, char **to_free);

+const char *nm_utils_str_utf8safe_unescape (const char *str, char **to_free);

+

+char *nm_utils_str_utf8safe_escape_cp   (const char *str, NMUtilsStrUtf8SafeFlags flags);

+char *nm_utils_str_utf8safe_unescape_cp (const char *str);

+

+char *nm_utils_str_utf8safe_escape_take (char *str, NMUtilsStrUtf8SafeFlags flags);

+

+/*****************************************************************************/

+

 #endif /* __NM_SHARED_UTILS_H__ */

-- 

2.9.4

From e9eee9c65818e7dd85e79c1db6ad4c32b4c7fb52 Mon Sep 17 00:00:00 2001

From: Thomas Haller <thaller@redhat.com>

Date: Tue, 16 May 2017 14:11:07 +0200

Subject: [PATCH 06/13] device: sanitze UTF-8 values for D-Bus

  ip link add name $'d\xccf\\c' type dummy

Use nm_utils_str_utf8safe_escape() to sanitize non UTF-8 sequences

before exposing them on D-Bus. The operation can be reverted client

side via nm_utils_str_utf8safe_unescape() or simply g_strcompress().

Note that this preserves all valid UTF-8 sequences as-is, with exception

of the backslash escape character and ASCII control characters. Thus, this

is a change in behavior for strings that contain such characters.

Note that nmcli is not changed to somehow unescape the string before

printing. As the string is not valid UTF-8 (or contains ASCII characters

that need escaping), they are not printable as-is, so unescaping before

printing makes little sense.

(cherry picked from commit 0870906540506d0157f305df32b6b1f65b10ee85)

(cherry picked from commit 3a96772918a391ec8186183b5c14c9b165322d3a)

---

 .../org.freedesktop.NetworkManager.Device.xml      | 15 +++++++++++

 src/devices/nm-device.c                            | 31 ++++++++++++++++------

 2 files changed, 38 insertions(+), 8 deletions(-)

diff --git a/introspection/org.freedesktop.NetworkManager.Device.xml b/introspection/org.freedesktop.NetworkManager.Device.xml

index ee42410..be0a612 100644

--- a/introspection/org.freedesktop.NetworkManager.Device.xml

+++ b/introspection/org.freedesktop.NetworkManager.Device.xml

@@ -21,6 +21,9 @@

         each device in your application, use the object path. If you're looking

         for a way to track a specific piece of hardware across reboot or hotplug,

         use a MAC address or USB serial number.

+

+        Note that non-UTF-8 characters are backslash escaped. Use g_strcompress()

+        to obtain the true (non-UTF-8) string.

     -->

     <property name="Udi" type="s" access="read"/>

@@ -28,6 +31,9 @@

         Interface:

         The name of the device's control (and often data) interface.

+        Note that non UTF-8 characters are backslash escaped, so the

+        resulting name may be longer then 15 characters. Use g_strcompress()

+        to revert the escaping.

     -->

     <property name="Interface" type="s" access="read"/>

@@ -38,6 +44,9 @@

         not refer to the actual data interface until the device has successfully

         established a data connection, indicated by the device's State becoming

         ACTIVATED.

+        Note that non UTF-8 characters are backslash escaped, so the

+        resulting name may be longer then 15 characters. Use g_strcompress()

+        to revert the escaping.

     -->

     <property name="IpInterface" type="s" access="read"/>

@@ -45,6 +54,8 @@

         Driver:

         The driver handling the device.

+        Non-UTF-8 sequences are backslash escaped. Use g_strcompress()

+        to revert.

     -->

     <property name="Driver" type="s" access="read"/>

@@ -52,6 +63,8 @@

         DriverVersion:

         The version of the driver handling the device.

+        Non-UTF-8 sequences are backslash escaped. Use g_strcompress()

+        to revert.

     -->

     <property name="DriverVersion" type="s" access="read"/>

@@ -59,6 +72,8 @@

         FirmwareVersion:

         The firmware version for the device.

+        Non-UTF-8 sequences are backslash escaped. Use g_strcompress()

+        to revert.

     -->

     <property name="FirmwareVersion" type="s" access="read"/>

diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c

index ed9bc49..e61bde3 100644

--- a/src/devices/nm-device.c

+++ b/src/devices/nm-device.c

@@ -13993,28 +13993,43 @@ get_property (GObject *object, guint prop_id,

 	switch (prop_id) {

 	case PROP_UDI:

-		g_value_set_string (value, priv->udi);

+		/* UDI is (depending on the device type) a path to sysfs and can contain

+		 * non-UTF-8.

+		 *   ip link add name $'d\xccf\\c' type dummy  */

+		g_value_take_string (value,

+		                     nm_utils_str_utf8safe_escape_cp (priv->udi,

+		                                                      NM_UTILS_STR_UTF8_SAFE_FLAG_NONE));

 		break;

 	case PROP_IFACE:

-		g_value_set_string (value, priv->iface);

+		g_value_take_string (value,

+		                     nm_utils_str_utf8safe_escape_cp (priv->iface,

+		                                                      NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL));

 		break;

 	case PROP_IP_IFACE:

-		if (ip_config_valid (priv->state))

-			g_value_set_string (value, nm_device_get_ip_iface (self));

-		else

+		if (ip_config_valid (priv->state)) {

+			g_value_take_string (value,

+			                     nm_utils_str_utf8safe_escape_cp (nm_device_get_ip_iface (self),

+			                                                      NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL));

+		} else

 			g_value_set_string (value, NULL);

 		break;

 	case PROP_IFINDEX:

 		g_value_set_int (value, priv->ifindex);

 		break;

 	case PROP_DRIVER:

-		g_value_set_string (value, priv->driver);

+		g_value_take_string (value,

+		                     nm_utils_str_utf8safe_escape_cp (priv->driver,

+		                                                      NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL));

 		break;

 	case PROP_DRIVER_VERSION:

-		g_value_set_string (value, priv->driver_version);

+		g_value_take_string (value,

+		                     nm_utils_str_utf8safe_escape_cp (priv->driver_version,

+		                                                      NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL));

 		break;

 	case PROP_FIRMWARE_VERSION:

-		g_value_set_string (value, priv->firmware_version);

+		g_value_take_string (value,

+		                     nm_utils_str_utf8safe_escape_cp (priv->firmware_version,

+		                                                      NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL));

 		break;

 	case PROP_CAPABILITIES:

 		g_value_set_uint (value, (priv->capabilities & ~NM_DEVICE_CAP_INTERNAL_MASK));

-- 

2.9.4

From 0b8676b887f63a708e6444f6b3d19003a2f9b4c8 Mon Sep 17 00:00:00 2001

From: Thomas Haller <thaller@redhat.com>

Date: Wed, 17 May 2017 11:48:53 +0200

Subject: [PATCH 07/13] libnm: UTF-8 sanitize strings from UDev in NMDevice

(cherry picked from commit b9e9f7616556f693e2642ed433f3289f9c6da452)

(cherry picked from commit d7b184d99257a6e6e59b22709007675430ec308b)

---

 libnm/nm-device.c | 273 ++++++++++++++++++++++++++++++------------------------

 1 file changed, 152 insertions(+), 121 deletions(-)

diff --git a/libnm/nm-device.c b/libnm/nm-device.c

index 9cbdbd0..7e8feb1 100644

--- a/libnm/nm-device.c

+++ b/libnm/nm-device.c

@@ -81,7 +81,7 @@ typedef struct {

 	GPtrArray *available_connections;

 	struct udev *udev;

-	char *product, *short_product;

+	char *product;

 	char *vendor, *short_vendor;

 	char *description, *bus_name;

@@ -320,7 +320,6 @@ finalize (GObject *object)

 	g_free (priv->driver_version);

 	g_free (priv->firmware_version);

 	g_free (priv->product);

-	g_free (priv->short_product);

 	g_free (priv->vendor);

 	g_free (priv->short_vendor);

 	g_free (priv->description);

@@ -1357,6 +1356,17 @@ _get_udev_property (NMDevice *device,

 	return db_value;

 }

+static char *

+_get_udev_property_utf8safe (NMDevice *device,

+                             const char *enc_prop,  /* ID_XXX_ENC */

+                             const char *db_prop)   /* ID_XXX_FROM_DATABASE */

+{

+	return nm_utils_str_utf8safe_escape_take (_get_udev_property (device,

+	                                                              enc_prop,

+	                                                              db_prop),

+	                                          NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL);

+}

+

 /**

  * nm_device_get_product:

  * @device: a #NMDevice

@@ -1365,6 +1375,9 @@ _get_udev_property (NMDevice *device,

  *

  * Returns: the product name of the device. This is the internal string used by the

  * device, and must not be modified.

+ *

+ * The string is backslash escaped (C escaping) for invalid characters. The escaping

+ * can be reverted with g_strcompress(), however the result may not be valid UTF-8.

  **/

 const char *

 nm_device_get_product (NMDevice *device)

@@ -1374,15 +1387,16 @@ nm_device_get_product (NMDevice *device)

 	g_return_val_if_fail (NM_IS_DEVICE (device), NULL);

 	priv = NM_DEVICE_GET_PRIVATE (device);

-	if (!priv->product)

-		priv->product = _get_udev_property (device, "ID_MODEL_ENC", "ID_MODEL_FROM_DATABASE");

+	if (!priv->product) {

+		priv->product = _get_udev_property_utf8safe (device, "ID_MODEL_ENC", "ID_MODEL_FROM_DATABASE");

-	/* Sometimes ID_PRODUCT_FROM_DATABASE is used? */

-	if (!priv->product)

-		priv->product = _get_udev_property (device, "ID_MODEL_ENC", "ID_PRODUCT_FROM_DATABASE");

+		/* Sometimes ID_PRODUCT_FROM_DATABASE is used? */

+		if (!priv->product)

+			priv->product = _get_udev_property_utf8safe (device, "ID_MODEL_ENC", "ID_PRODUCT_FROM_DATABASE");

-	if (!priv->product)

-		priv->product = g_strdup ("");

+		if (!priv->product)

+			priv->product = g_strdup ("");

+	}

 	return priv->product;

 }

@@ -1395,6 +1409,9 @@ nm_device_get_product (NMDevice *device)

  *

  * Returns: the vendor name of the device. This is the internal string used by the

  * device, and must not be modified.

+ *

+ * The string is backslash escaped (C escaping) for invalid characters. The escaping

+ * can be reverted with g_strcompress(), however the result may not be valid UTF-8.