Bug in Report_Rule parsing (SPA50x, fw 7.5.x)

[Dan Lukes]

Report_Rule defined as: https://$(A)/Cisco/Report.php?PSN=$PSN;Product=$PN;SW=$SW

has expanded to POST /Cisco/Report.php?PSN=508G;Product=SPA508G;SW=7.4.9 on 7.4.9 firmware

starting with 7.5.2b (verified on 7.5.3 also) it expand to request POST /Cisco/Report.php?PSN=508G only instead

SYSLOG message claim:

Facility local3 (19), Severity debug (7)

Msg: first_rule is https://test...(deleted)...cz/Cisco/Report.php?PSN=508G, second_rule is Product=SPA508G;SW=7.5.3.\0x0a

Unfortunately, it seems that programmer in charge has used ';' as some sort of internal delimiter, not properly sanitizing user input or, at least, describing the special meaning of ';' in documentation.

[meszaros_mihaly]

Deployment and Provisioning Guide

on page 87

see the example:

[--delta]http://my_http_server/config-525.xml; [--status]http://my_http_server/

status-525.xml

So maybe ";" is used as separator this why it is not working for you.

[Dan Lukes]

Hm. Nice backward incompatibility. Well, my fault, i missed it. Thank you.

As I mentioned in other thread, it's costly to read all documentation, technical and application notes over and over to track changes. Especially when documents like 'Deployment and Provisioning Guide' has no version number nor release date.

It would be nice to have exact formal specification of syntax of configuration, unfortunatelly 'exact' and 'formal' is not the way of Cisco's technical documentation ...

So how the special characters can be encoded to Report_Rule URL ? The standard escaping (like & -> &) contain ';' which is forbidden character now ...

Can you enlight me, Cisco ?

[klogata]

Hi,

I'm sorry that you find our documentation lacking. Please continue to provide feedback as we do strive to give accurate documentation to our customers. While we do monitor the Support Community, the best way to submit feedback is to use the "Feedback" link at the bottom of the web page for the documentation you are viewing. While our publishing system does not automatically publish the date or version number of docs, we normally put that information on the page after the title page, or at the end of the document. I see that the Provisioning Guide does not have that information, so I will update that as soon as possible.

I know that the report rule behavior was changed in release 7.5.3, which was documented in the Release Notes and the Administration Guide. Unfortunately, I don't know the answer to your question, but I will forward it to one of the engineers and get back to you with the information. We will also update the documentation with this information.

Thanks,

Kerry

[Dan Lukes]

Thank you very much for your support.

According the feedback - as far as I know, there is no page "for the page documentation I'm viewing" speaking about Deployment and Provisioning Guide. According my best knowledge, such Guide is avaiable as PDF only, with no "feedback" link within it. There is no HTML version of such document.

Note the Cisco know how to create formal, complete and exact documentation with list of all tags, syntax and detailed description. See any Cisco Catalyst switch documentation like this. In advance such documentation is avaiable in two formats, as online compatible HTML as well as offline proprietary PDF (which I can't open on platforms where Adobe Reader is not avaiable).

Just for the completeness - my original question is older than 7.5.3 release and is based on behavior change in 7.5.2b. So, it's too late to mention it with release notes of 7.5.3. Also, I suspect that no updated Deplyment and Provisioning Guide has been avaiable at the time of my question. Even in the case it has been avaiable, it dedicate the change to 7.5.3, not 7.5.2b version.

[klogata]

Hi,

I will let you know as soon as I get information about the change. I checked our docs and notes and did not find any information about a report rule change in 7.5.2b -I apologize if this has been overlooked.

Regarding the documentation formats, we are working to get our (Small Business) documentation converted so that we can use Cisco.com to publish HTML and PDF at the same time instead of PDF only. In the meantime, if you need to submit feedback on a doc, please use the link from the "listing page" (the page from which you click the PDF link). If you include the doc title, it should reach the appropriate people.

Thank you again for the feedback and please continue to let us know how we can improve.

[klogata]

Hi,

Engineering researched the issue and it is a bug (design error) that needs to be fixed. (The semi-colon should not be used as the delimiter of two report rules.) I will let you know when I have more information.

In the meantime, the documentation will be clarified with this information to show the current behavior:

Beginning with firmware version 7.5.2b, the IP phone has the capability to do a delta configuration report and a status report. The phone reports the status data if the [--status] keyword is defined.

Both the status report rule and configuration report rule can be configured in the parameter . These two report rules should be separated with a semi-colon.

If the [--status] keyword or the status report file path is missing, the phone will not report the status data.

For example, if the following is configured:

http://my_http_server/config-525.xml

The phone will report the configuration data to

http://my_http_server/config-525.xml.

If the following is configured:

[--status]http://my_http_server/status-525.xml

The phone will report the status data to

http://my_http_server/config-525.xml.

If the following is configured:

[--delta]http://my_http_server/config-525.xml;

[--status]http://my_http_server/status-525.xml

The phone will report the delta configuration data to

http://my_http_server/config-525.xml and the

status data to http://my_http_server/status-

525.xml.

[klogata · Accepted solution]

Hi,

Sorry for the delay in following up, but this bug will be fixed in the next software release. Here is the information from the engineer:

I will change the code to use SPACE as the delimiter since a space normally terminates a URL. If a space is needed in a URL, it should be encoded to %20. 

Hope this helps.

Kerry

[Dan Lukes]

It has been fixed in 7.5.5, thank you.

Unfortunately, parsing of Rule Report is still broken - variable expansion doesn't encode characters correctly, the spaces are expanded unencoded causing wrong split then. See Firmware bug: $CCERT must not be used in Report_Rule for more.