From nobody Tue Jul 14 21:21:58 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1783681913; cv=none; d=zohomail.com; s=zohoarc; b=JRlNfi5+Hp4h998zkdE4+u+TGKaIEmxzR6S0/8KdOpF8tR08H5lRQcYio8wduJMVzZd/AJo58bH/G1tdZdcQ8aAB9aPZxuyIdXQncbew7rg/eE+Is4FfaiUjZk/gjNSipf1OcJ+mWP1CwKOEvjI2+FvNDDcU4X2L5LaMDBJ7Gog= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783681913; h=Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=0MlrNMFWWVAW86SLJ2P8NOnIg1+4PqAhWcP7UB5gWXI=; b=cJvxPWdUKmcgVnNOhuDPNjtFzcPZY7WLBUJ+nVdaVJsiKYOf5TC/SRhHH2Wy50YtLl22dcGdt1kaAQIoVih1aVlcF2rHOkiuh3WuNbuUBkPB0+H5jkFNUlBk62cFs+JNHfSv/dx5seKAbclykjOM1QtSRZaaRkTcOE+MP9wk7T4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1783681913889645.528102826559; Fri, 10 Jul 2026 04:11:53 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id AB80241C61; Fri, 10 Jul 2026 07:11:52 -0400 (EDT) Received: from [172.19.199.10] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 94D8341C5A; Fri, 10 Jul 2026 07:09:33 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id CD2B341BA4; Fri, 10 Jul 2026 07:07:13 -0400 (EDT) Received: from mail-qk1-x729.google.com (mail-qk1-x729.google.com [IPv6:2607:f8b0:4864:20::729]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 2ACCC41B65 for ; Fri, 10 Jul 2026 07:07:13 -0400 (EDT) Received: by mail-qk1-x729.google.com with SMTP id af79cd13be357-9204711e831so63724685a.2 for ; Fri, 10 Jul 2026 04:07:13 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id af79cd13be357-92ee5cf7ab2sm165527185a.30.2026.07.10.04.07.11 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 10 Jul 2026 04:07:11 -0700 (PDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783681632; x=1784286432; darn=lists.libvirt.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=0MlrNMFWWVAW86SLJ2P8NOnIg1+4PqAhWcP7UB5gWXI=; b=aBOG1kD1DvS0zH0ySRfSAHcW9MKeCpxo8zwBGU1j50qBC7bk0yIczpFfJLIq9fBP1Q TqInU9LXpRnCmUbQO4lQyGpsiJK0edmMcnR210sgGPBa6lPKjSwKaYN+YCchF39z60q/ pJJadFXSnZ4639nK2Fxf28wycfsmLPss/ra+g7unT1NjjRuGbwmIP4pGpvQD0IKzWISg +niKWmnFDlqX0PupYgSqkWcq723wLwZTVLtLgyzXw1XIWORBiqBgOOZfWwSnyPQYQXtN hICLIzvMFQ8O2ha5l+Mip8D7qp6yEyUYpJ7rGbgBnv/U2LowGrhQ4EfEPYfPawR12jLA fw7Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783681632; x=1784286432; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=0MlrNMFWWVAW86SLJ2P8NOnIg1+4PqAhWcP7UB5gWXI=; b=lo01Z08ipsVFuHNwKUbn1+G7VN44cC9/wTpdwSl+w+xJaRBPYwjFP7Fch8nFMeudxn PtEbRE9dpWimst8b7GHcXhMInKUW4wzBcNQstchXxO1oGajKH4L88d6OXJreauYSP/Jk xGxLT+oEHIa3L6ea+iMokBe37OCViK3A1x8Vb4/9s2AoTkPuTeRS+eWX9OSFXT5dD4sU ZSJB/3zMJjpFy3A55MT1BaiTs9YXnTgKLNIZQ2wA3HiRgu99jVifE1qpMPL/smJA2HLh YZWezb54tEAg0+c4+6z0/mtEWq0o9It+c9FVMCoucnFoajIiTKCRYsXTQ8h+FCHghyHk t5SA== X-Gm-Message-State: AOJu0YwQatkdlYEsxRpHNNY8n4B/ubSxVXP8UZpYeMwHqkia9oJFn9zo fXsuoGPRBldcZIjB2cNj+tfp4CfVqsxYVtgqrQQvP5zZ5vZ/aSYdVVf7HxoncnW9Ms4= X-Gm-Gg: AfdE7cklOwtodtAn+RG4KS8dJC+YjTfVVBAhRi5Zb+Pn2qhVYaxrYby1Bdt35/UYwYz w5m1I9uqSysabb7LDunriKHQx/g5mivCSkH689L1uXKr4QKvBDPH+/i6042T8pgfzuNniA002/l yfPUK3Aske075xP8aD0dl4idRbV+tu/F47KWEJKl1y056up48el4ih/x+ZhczkukPYVLJ0Ayt8p 6Iw5HCGweJ/ID7ukXReFHwZa1SKwExbCiqfrg1ScvZ4e+Ox5Dmtd7BXNPxmWk8p4hTGdIik3gn4 I6RlWWhP5AxwRqDOYQmdwG88BEnUm+VmSnCTGMlRCqSWpSdmT9LYUIU0bL8uNMkNtnix6iE7+ai wbcte7BzZfmOyu3OxpnfzEGYJ+bBNC7TWuxifayekj8P2UDrZNZPsv2i1aHwzr+9pzmO5n6tU1d wmaEiqIi5H4pz6XGZdbn1qmXVJ8OAJnOf3khgU1UYfF4r9WzB976DwVzkf61dnsA2Jbvg7+Xpm6 cI6w4ePUSKYV2m+LKqm4dpc7BUcN5vs X-Received: by 2002:a05:620a:8085:b0:910:87f4:9a26 with SMTP id af79cd13be357-92ecf6988a0mr1168024585a.41.1783681632451; Fri, 10 Jul 2026 04:07:12 -0700 (PDT) From: Michael Bommarito To: devel@lists.libvirt.org Subject: [libvirt PATCH 1/4] conf: reject line breaks in DNS TXT record values Date: Fri, 10 Jul 2026 07:06:58 -0400 Message-ID: <20260710110701.278146-2-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260710110701.278146-1-michael.bommarito@gmail.com> References: <20260710110701.278146-1-michael.bommarito@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-MailFrom: michael.bommarito@gmail.com X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation Message-ID-Hash: 5ZJT5BK73AWXSRJ42DXBLSRPYCGVDDXJ X-Message-ID-Hash: 5ZJT5BK73AWXSRJ42DXBLSRPYCGVDDXJ X-Mailman-Approved-At: Fri, 10 Jul 2026 11:09:19 +0000 X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1783681915478158500 Content-Type: text/plain; charset="utf-8" The network XML schema exposes typed DNS records through the element. The TXT value attribute accepts XML numeric character references, including (LF) and (CR), which survive attribute-value normalization. The network driver later writes the value verbatim into dnsmasq's line-oriented configuration file as a txt-record=3D line, so an embedded line break ends that directive and starts a new one under attacker control. This is a real boundary where a management layer permits editing typed DNS records while withholding the raw passthrough: the injected line escapes that restriction. Direct read-write access to the libvirt socket is already root-equivalent, so for the default deployment this is schema-correctness hardening. Add a helper that rejects LF and CR and call it for the TXT value during XML parsing. CVE-2026-61477 Fixes: 8b32c80df089 ("network: put dnsmasq parameters in conf-file instead = of command line") Signed-off-by: Michael Bommarito --- src/conf/network_conf.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c index abd4c6eb4e..307ab0ae24 100644 --- a/src/conf/network_conf.c +++ b/src/conf/network_conf.c @@ -724,6 +724,23 @@ virNetworkDNSHostDefParseXML(const char *networkName, "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" \ "_-+/*" =20 + +static int +virNetworkDNSDefCheckLineBreaks(const char *record, + const char *field, + const char *value) +{ + if (virStringHasChars(value, "\r\n")) { + virReportError(VIR_ERR_XML_DETAIL, + _("invalid line break in DNS %1$s record %2$s attri= bute"), + record, field); + return -1; + } + + return 0; +} + + static int virNetworkDNSSrvDefParseXML(const char *networkName, xmlNodePtr node, @@ -852,6 +869,9 @@ virNetworkDNSTxtDefParseXML(const char *networkName, goto error; } =20 + if (virNetworkDNSDefCheckLineBreaks("TXT", "value", def->value) < 0) + goto error; + if (!(def->name || def->value)) { virReportError(VIR_ERR_XML_DETAIL, _("Missing required name or value in DNS TXT record= of network %1$s"), --=20 2.53.0 From nobody Tue Jul 14 21:21:58 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1783681968; cv=none; d=zohomail.com; s=zohoarc; b=SxCyDAEZdMLsQnqnVRImlvL41rfdRr/slBfUZdHIDBLUoMr+aAh2gRm+UGZSkAl0uOnI0FR6ZquJwo/R9BjkIGfNmwr8zzUfUXowCb605I4JcTPljLzcaOEKKNM7tO+Y749FVCuSEavSOGrlsE3zaXqwCnNqu8R5E87a3GsN9Hk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783681968; h=Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=B5CM40+G9KEG4/9MqpDT7Zt9s4MD02UtZ2dAMzla02w=; b=FMsRw0coY/0SpOpqMwvxb3EZzaRvxv/QvUI4wtNVsM7vRqOiigsWenQKP5vwCQB8ExcL4Av4dWMWUSx6hT4Wk7zjJi/0ItyaJZjEBfHnaMPwlFli5r5JYOKGdOygMpg3RDHmA94cEUig4wnuXWlQz3Sd7v0FDh5ffBUXO5uZOFA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1783681968678838.7922316127355; Fri, 10 Jul 2026 04:12:48 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id A44BE41887; Fri, 10 Jul 2026 07:12:47 -0400 (EDT) Received: from [172.19.199.10] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 6271741DFF; Fri, 10 Jul 2026 07:09:38 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 5B5A341AE0; Fri, 10 Jul 2026 07:07:15 -0400 (EDT) Received: from mail-qk1-x735.google.com (mail-qk1-x735.google.com [IPv6:2607:f8b0:4864:20::735]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id C981C41B65 for ; Fri, 10 Jul 2026 07:07:14 -0400 (EDT) Received: by mail-qk1-x735.google.com with SMTP id af79cd13be357-92e5c92c389so35791385a.3 for ; Fri, 10 Jul 2026 04:07:14 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id af79cd13be357-92ee5cf7ab2sm165527185a.30.2026.07.10.04.07.12 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 10 Jul 2026 04:07:13 -0700 (PDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783681634; x=1784286434; darn=lists.libvirt.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=B5CM40+G9KEG4/9MqpDT7Zt9s4MD02UtZ2dAMzla02w=; b=C+4WdyaljxDM0tFhqlFPM4MiuU6kohhRUdTGyhoFaDpzOIJUGzP24UAmkDcn+sWyWW B8LyGPOoc5kabtRzDkztqf/ekigldnMrRG1pjs36peIXoCYDn747HxoQXSlLL676EYF9 WN5Ib9+zRQ2bMP2kre23AuPqTTnRgWwG76iA4LSG1I+4xmRV/JAq0Xdq/90daWRS7ycl TD6QfuMexU/npzt0jHpVBoNtQ2Vhrx910+0JW7zAXOSogngYzZoCZ16YyvDRAWETg/nI fyamiTf5kjxmR0ebR8NT2bjiLzjzXTJo13SOA5aNCj2D8gyFvzi+gGJBVcBzLotkAHfr ONWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783681634; x=1784286434; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=B5CM40+G9KEG4/9MqpDT7Zt9s4MD02UtZ2dAMzla02w=; b=dZK4rLVFA1CaEOdFJbbqrH020j2KSLUFezuc6FjTf3oOSANUrz0L5btLNi1DqqUNSb zjvVlv8NSpL58Z3ptM/YkQ4KtbOHpjah2K7IFXlPpAE6H4OnXiD6sFB74BcKfjyNoXto sLFa9hUKUKMGBBJz8t/n04PmU6a1FvmGZvlvk433xsUQn+YBH6UBsCVWCMj/EHc4W3HG iyiDTdt58ayZDnzLhAhI9X73mi4q8GN1bD2qEZwhAJubgzPfN8bGfGX0Trjco+pnoGNl xDPUaq2BmmzKzLB3SdFl1xgJRBCluLAruLP2gmA17tJiLJGWdx2ertDrLpLA/vUWB8yX Zcog== X-Gm-Message-State: AOJu0YyrdiU0QeNjzGr8ZD4gR9hOTwPvEdpcKXS6pDNWwtns87DcE4vR 6Yhi/q/B5hrTdYJTu6Pabo0W12S+YDJMbRViXGpnVkfq4ziDfn4HoYKxxZhRhdhOnsc= X-Gm-Gg: AfdE7cn0NdDFsrbgC+vudtvCLh+Egg+JQFUps7SYr9Jn7EVFfatlYSHBXyhj29HTuS3 XoM277bHiXL+5wB8G5T3aabNZWwYw8UGJJ+0tJ/Bi5Fcw4CbBSkYzaxycAOt2rs2EKJpbH4KJGJ DcmdnOdxA2DfvBr5Nynh7j8eYOqjousGLKcOViqOsl7Rv7hYth+uT9cHOHt/747smkPiiSEJ2MR murVwGD3MTrcbKh51VnMmTsfZ/A/ZZsEM5FZ6QA4d7LAum8RQSXt4IR1k6ng2z1SxA2OzRldiv5 3EnzSVb/zYd9pTEI6uJle9+9P/aNnFodHLsPI3rzvEGnijAzMXSOXaZtdV5sJovRGM7+nr/dV68 Q4a3TFQkU9SKPOMDE7GDtGhalAvo+bdEcY75rSEecT0gk0HDLlFosVu3puokN9baL+sxIs8Oqqd 3giPqgBRdIb5MShfdskZdk/PxRasq096e8JP1sxjM3z0sFcZDKKGtXGanW4+d/J/5Jld5cgugAD ZCtBAJtwJPidKMArJ9ctWOepEsmMpBM X-Received: by 2002:a05:620a:a012:b0:92e:e6e1:d083 with SMTP id af79cd13be357-92ee6e1d934mr172167085a.52.1783681634086; Fri, 10 Jul 2026 04:07:14 -0700 (PDT) From: Michael Bommarito To: devel@lists.libvirt.org Subject: [libvirt PATCH 2/4] conf: reject line breaks in DNS SRV domain and target Date: Fri, 10 Jul 2026 07:06:59 -0400 Message-ID: <20260710110701.278146-3-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260710110701.278146-1-michael.bommarito@gmail.com> References: <20260710110701.278146-1-michael.bommarito@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-MailFrom: michael.bommarito@gmail.com X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation Message-ID-Hash: D47QDB33I2XIAF2S5G7KA7MDSGC3SMKV X-Message-ID-Hash: D47QDB33I2XIAF2S5G7KA7MDSGC3SMKV X-Mailman-Approved-At: Fri, 10 Jul 2026 11:09:19 +0000 X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1783681969815158500 Content-Type: text/plain; charset="utf-8" The domain and target attributes flow through the same dnsmasq configuration emitter as TXT values, written into srv-host=3D lines. Like the TXT value they accept XML numeric character references for LF and CR and are not otherwise constrained, unlike service and protocol which already have allow-lists. An embedded line break ends the srv-host=3D directive and begins a new one. Reject LF and CR in the SRV domain and target during XML parsing, reusing the helper added for TXT values. CVE-2026-61477 Fixes: 6612d1adb794 ("network: fix problems with SRV records") Signed-off-by: Michael Bommarito --- src/conf/network_conf.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c index 307ab0ae24..8eba1321d6 100644 --- a/src/conf/network_conf.c +++ b/src/conf/network_conf.c @@ -792,6 +792,10 @@ virNetworkDNSSrvDefParseXML(const char *networkName, def->domain =3D virXMLPropString(node, "domain"); def->target =3D virXMLPropString(node, "target"); =20 + if (virNetworkDNSDefCheckLineBreaks("SRV", "domain", def->domain) < 0 = || + virNetworkDNSDefCheckLineBreaks("SRV", "target", def->target) < 0) + goto error; + ret =3D virXPathUInt("string(./@port)", ctxt, &def->port); if (ret >=3D 0 && !def->target) { virReportError(VIR_ERR_XML_DETAIL, --=20 2.53.0 From nobody Tue Jul 14 21:21:58 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1783682024; cv=none; d=zohomail.com; s=zohoarc; b=CCxZzkUfEajjO4B2VTiyJgrFKOIYACQDSO2TR98i8mgzQAsqBw6K6dbKKnIer5IWSMoq46ivVUEtzxN4O6ChUAWBkJqWdCMIph9cd6vEktoNNliS53+x02bXYXXCpqdd3eO+DPGTgEVg2ti12kmXD8XsskSWp8xdcOvQ8IfucGk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783682024; h=Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=k4X+zJ1/Nru3eEKGe2tkfLjmciEN5/eyAS9aG3J5sE8=; b=fr5hPb/Ubrzm6ZbL1SFmY51cAzuZ7HFYibNpSzvAj9ahhKA0fFSlqS0ZHS+WWVAtQ7rPfroayk5pMmktOAS0Ld0qm6rw3S2TBHPa4b7uFrSRkEHPguR37Zg7YXAo9al+EHTJBOtABjPMrY4L45VNcyhQjVSYstjRviNnd+FstpU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1783682024413657.0489560792939; Fri, 10 Jul 2026 04:13:44 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 146FD3F956; Fri, 10 Jul 2026 07:13:43 -0400 (EDT) Received: from [172.19.199.10] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id BDE0641E43; Fri, 10 Jul 2026 07:09:42 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 2528141AE0; Fri, 10 Jul 2026 07:07:17 -0400 (EDT) Received: from mail-qk1-x729.google.com (mail-qk1-x729.google.com [IPv6:2607:f8b0:4864:20::729]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 6A35241B70 for ; Fri, 10 Jul 2026 07:07:16 -0400 (EDT) Received: by mail-qk1-x729.google.com with SMTP id af79cd13be357-92e4fd65b2bso35910685a.0 for ; Fri, 10 Jul 2026 04:07:16 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id af79cd13be357-92ee5cf7ab2sm165527185a.30.2026.07.10.04.07.14 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 10 Jul 2026 04:07:14 -0700 (PDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783681636; x=1784286436; darn=lists.libvirt.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=k4X+zJ1/Nru3eEKGe2tkfLjmciEN5/eyAS9aG3J5sE8=; b=UJ/Wnsg8JgdM8gemGf7Y+Ok0+9Dijwh8aOQVA3nye+jHcZ3yV3OKqDMQE5O3B7DYef yx8aZ2Jy9sVPt6YFvZIyThVsuzPaVuHeetNsb746Hn7q5HZmYIgS72zDDJS77AK8NnnR WclQBkbHDKWSVIMpSODZ6ttXTaYshn+2XuQL6hLpUIMjGLWXVi6Lku8RsvXIWhPaWOoE 7sknhdirTSSRG2ytz5exUvr6/AYaE5kCjbE9azhIwM9kOALGT1DRLK0bg4zh5JxKfktZ Lc5Y5ElyEL1OcyEND+FXBqQ7yLaz/aRCrgFfR5VmgGAPzYXh8sKWzPlQZGaFpmKiZH8j /JgQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783681636; x=1784286436; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=k4X+zJ1/Nru3eEKGe2tkfLjmciEN5/eyAS9aG3J5sE8=; b=XnUjl15zr9mk/2mbnOpE+B58J482CreY6FEZdGK4M2IdNQXzshem7/AtC9DAhJpQKQ R5c9Q5ZyFzlI61GpnzSeN+9oQs1OhvQAe2r2HnlKFtm87hax/MCcWg7/L/xhpO443AA/ fvBx7+fPTTobfICcZx7/p9krk3P0tENIIls6ZEggW2LFlHuK+xhHSao/D63gCuWlC0YT WbKZkVYm64EV8UAD+Y2TQGcc+10OZvU9DGUuQDzM/6lySWujT07b9UHipa7v90qidc6Q NBzHWhn4yXMWT11TQyOVdqVoLBibTT9Q/znPcV+lgYN3X+cSPb6Ix0CgI7dUANOPifGR ECng== X-Gm-Message-State: AOJu0YwV43AV1KHpzKxseoHzy6Qs/cmHxzhhfYIx9fn8Lco6Om1T171I /ht52EeSaw1XuZyY4ErGu686c2CqgAfTrakmqwwW1T9+iB922ajtpap2pBy+kBMf8MI= X-Gm-Gg: AfdE7cn8z7cToJS34RNa+otR2Z3rSvIRYUTzjv89RhDBog/Logt2+qF8GKNg8rnxsHv sV2M8PQ+dOEKcIejK2c1kDLQRK7VRuWMO8S54Vl9BjsYGRmUyjMw7qGW1nIEJN4Cd9DljKiZ6V+ ulM2qbT9gd8VEi4DZCBeHl0gUoZQs95Ec1TI4AnWWDsK/hEwACko336UbPXefEHI9kxIx9hdTjm Dg+WxBCMO+i+XjYQU7QoLmjyBRQmLCEccVnRcoy1hUt7pVLUQcjgvifdHAm1eviD2ACwf3wMWCC Ohvts1pDAXTCX7A2sQQ2hyahfPQs9m2rsa5hcSCvb9rfTinc5T5GX0T6DdjJg30MkJNrPwjTlfR 1cPN5bW2PiM5WFAsX2WNaGWPfj2/uFdILMRJBaMVhzd6yaUIl/QotAuiTfxUfRglTm16usnzDWK IBhyrE8PlI6j9UV4jYQXHnokY99YWEdqsi0oYm8GtyM8CKvrAYOddao+ZiKUlb/l+nwoZ/XwG2O x4W9oy+h/wT775LVT012E9JWIAQaPBD X-Received: by 2002:a05:620a:3195:b0:915:68dd:1eff with SMTP id af79cd13be357-92ecf68c95amr1284505285a.50.1783681635647; Fri, 10 Jul 2026 04:07:15 -0700 (PDT) From: Michael Bommarito To: devel@lists.libvirt.org Subject: [libvirt PATCH 3/4] network: reject line breaks before writing dnsmasq DNS config Date: Fri, 10 Jul 2026 07:07:00 -0400 Message-ID: <20260710110701.278146-4-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260710110701.278146-1-michael.bommarito@gmail.com> References: <20260710110701.278146-1-michael.bommarito@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-MailFrom: michael.bommarito@gmail.com X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation Message-ID-Hash: OXUCIP5YRKPOYDC5CBHBIOHOAXI55VUH X-Message-ID-Hash: OXUCIP5YRKPOYDC5CBHBIOHOAXI55VUH X-Mailman-Approved-At: Fri, 10 Jul 2026 11:09:19 +0000 X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1783682025547158500 Content-Type: text/plain; charset="utf-8" The parser now rejects line breaks in typed DNS TXT and SRV fields, but the dnsmasq configuration emitter is the actual trust boundary: any future parser gap, or a value reaching the emitter by another path, would again let a typed DNS field inject an arbitrary dnsmasq directive. Add a defensive check in networkDnsmasqConfContents() that rejects LF and CR in every typed DNS string immediately before it is written to the line-based configuration file. This sits behind the parser checks and keeps the emitter correct on its own. The raw namespace is intentionally left untouched: it is the documented escape hatch for arbitrary dnsmasq options, and sanitizing it would be a separate, deliberate behavior change. CVE-2026-61477 Fixes: 8b32c80df089 ("network: put dnsmasq parameters in conf-file instead = of command line") Signed-off-by: Michael Bommarito --- src/network/bridge_driver.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index 4dc3e5424b..6ebdc27e76 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -64,6 +64,7 @@ #include "virhook.h" #include "virjson.h" #include "virnetworkportdef.h" +#include "virstring.h" #include "virutil.h" #include "virsystemd.h" #include "netdev_bandwidth_conf.h" @@ -119,6 +120,22 @@ networkDnsmasqDefNamespaceFree(void *nsdata) G_DEFINE_AUTOPTR_CLEANUP_FUNC(networkDnsmasqXmlNsDef, networkDnsmasqDefNam= espaceFree); =20 =20 +static int +networkDnsmasqConfCheckLineBreaks(const char *record, + const char *field, + const char *value) +{ + if (virStringHasChars(value, "\r\n")) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("DNS %1$s record %2$s must not contain line break= s"), + record, field); + return -1; + } + + return 0; +} + + static int networkDnsmasqDefNamespaceParseOptions(networkDnsmasqXmlNsDef *nsdef, xmlXPathContextPtr ctxt) @@ -1300,6 +1317,10 @@ networkDnsmasqConfContents(virNetworkObj *obj, =20 if (wantDNS) { for (i =3D 0; i < dns->ntxts; i++) { + if (networkDnsmasqConfCheckLineBreaks("TXT", "name", dns->txts= [i].name) < 0 || + networkDnsmasqConfCheckLineBreaks("TXT", "value", dns->txt= s[i].value) < 0) + return -1; + virBufferAsprintf(&configbuf, "txt-record=3D%s,%s\n", dns->txts[i].name, dns->txts[i].value); @@ -1321,6 +1342,13 @@ networkDnsmasqConfContents(virNetworkObj *obj, def->name); return -1; } + + if (networkDnsmasqConfCheckLineBreaks("SRV", "service", dns->s= rvs[i].service) < 0 || + networkDnsmasqConfCheckLineBreaks("SRV", "protocol", dns->= srvs[i].protocol) < 0 || + networkDnsmasqConfCheckLineBreaks("SRV", "domain", dns->sr= vs[i].domain) < 0 || + networkDnsmasqConfCheckLineBreaks("SRV", "target", dns->sr= vs[i].target) < 0) + return -1; + /* RFC2782 requires that service and protocol be preceded by * an underscore. */ --=20 2.53.0 From nobody Tue Jul 14 21:21:58 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1783682100; cv=none; d=zohomail.com; s=zohoarc; b=F6satOjq1W2c6E5cjb9g7ZQ+PvA72usX2unUGMr8BN5wq3KdDksn0LJWjbPBF/wvHCT6fgCbCX2rSa/ma1Dyn9Pz6xPaTp8GX+/Aqc0v0i5vaaFVrsEh56zXR/abwfp9RAwFLt15NfMZQ3AqthezpxH3nvQOvddODMeQXchAmaY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783682100; h=Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=pCWK/Dtp/fIEcVUmrPqfsyxyxuE85oDAeMjbkdjCsfs=; b=QGT3B0WFTUzRT9QwoidlwwytfJaCnWU3g6sJapmkUR33jXxpBx+j0Z5cUGTUoYizYDIW4TaZIxKewa0QokaJpHRWBR0hf4YerK4ZZso/yvXzN8mmEpNJGcCQs4dJnkVFIypoJsXWDwGvHSPpeLH1Xc6b0G7Qnr1KGE9Pm1ypU18= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1783682100705930.5666673846391; Fri, 10 Jul 2026 04:15:00 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id A561E3F95E; Fri, 10 Jul 2026 07:14:59 -0400 (EDT) Received: from [172.19.199.10] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 226F8423EB; Fri, 10 Jul 2026 07:09:49 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 9590641BB5; Fri, 10 Jul 2026 07:07:19 -0400 (EDT) Received: from mail-qk1-x72e.google.com (mail-qk1-x72e.google.com [IPv6:2607:f8b0:4864:20::72e]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id E869C41BBE for ; Fri, 10 Jul 2026 07:07:17 -0400 (EDT) Received: by mail-qk1-x72e.google.com with SMTP id af79cd13be357-92e5b048375so34697385a.1 for ; Fri, 10 Jul 2026 04:07:17 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id af79cd13be357-92ee5cf7ab2sm165527185a.30.2026.07.10.04.07.15 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 10 Jul 2026 04:07:16 -0700 (PDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783681637; x=1784286437; darn=lists.libvirt.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=pCWK/Dtp/fIEcVUmrPqfsyxyxuE85oDAeMjbkdjCsfs=; b=GDEEO7HYiM1+dpf9Ib2EjEJH9SW7n32lKIIGKEVqs9YS6Kj28RCZryBtr6DctE2yNH c/hvKrRfv6LqaKRrER2M5efooulX94x9/P6JR+H3ZpzwOgS2ka8nvUCtfl7bqM4GfRyJ U5Lkxh9rdkbZu2E/bP2oBKS2bkEoKXEG7/awYV0TTLDLh2aZadMwtUNxqYu8oojFo6Pe dR8djgufahdmvfHzT43MKZsED7p5CgJGXjTw2CUjra8GIAjmKveOmLj3YSdDpRUnvQck eONzfK37LPAN3l6Vw0Nv2zAzcfrWEsiDmy900hXeVdk61d4Lrp3KnDFRpYqx5dwLs5vN pYxg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783681637; x=1784286437; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=pCWK/Dtp/fIEcVUmrPqfsyxyxuE85oDAeMjbkdjCsfs=; b=asJcJyEmdI+DiapjcfqOdHF70s/V5L0cYFX6kEwpQjPGlU95w6JD3Lc3B+Wm0+fCYQ 09U2kbETCRj0ieaKZZw9hHsPHpIeQf9uTyLl3dj4punTd20Hy86uXLJbi08jfmIdWQo8 h29sodJ65zAbujMjf/VUNeNTCJkgFWD1euhtpPyJTtfeo3Jqoa21b8br0qztK5v1nJEq umG6U1tV5S9GpRyaHf5sprcgBnjpfYlaank4Lg5O978TP+klSs+Xh0ZieenMwcbEXEBo sSAx6hAN9kUnag6P+iqSUx02LERTJcqj6uOxu3/PHbNBrAMiQder6VypsaFWV+ZFFCgM EvNA== X-Gm-Message-State: AOJu0Yzkijlgra0ZrqIK/IW9yoSMjsOngPuS35qXW6digSYoK8IihHAZ mkLF6cv6hO/LoIg76ZjYMB9ybrgRrAs2Vu8yxfeI1g3xbLcTzc8tFYUqezogvSWKV7o= X-Gm-Gg: AfdE7cmvSu58wA4Uo7KY68VBNfBJdonz3YbVWmGA5EWguhTy1E/ooa9SMBmyQba7hmn f6LEpRP3nto6P+ky7hGcyYvQFbaMNi2qs/2A134GxUdx6S5659XrlDTTJg2Vcrborg2r5ffRJ7e 3zr1rMUWR8BeuRue8Zd76241dzQjYVZ3cEXzezCWidnLhygtNo2VjQn5ZbXLJCNhBe1C4zL31iZ n4za+QlsWxAMQjdiyD6+CeGUQLURkBuGSfpzPICIuVZ7CfxhUVMUibW2YKNOaLoQCPG6fQgKj3F WubfleYLpJUOcalbe9gU3SffrHbib56M1RqFoLAi6U8t0DxtJEcmftU0Qw3BR6Mb44zKO8fpGlP fCP6tgDzFw6uUCI4KJx7lNh9rNIa5nPWncxJYQ5dDKX1Hzu/r8iywGUBF+oyyWOS3sb4l4Qm38l eCUbhZup8RUEopqx/puGqI+WvG156KJpIkdVb5KsPTbbR2pznqOKswJtEeKMCTHsYKG0WF2OdoB s4T54XtNGCibehlzeJOX1TI1BRIBE38q2SjiyuoUrM= X-Received: by 2002:a05:620a:460f:b0:92d:e54e:72db with SMTP id af79cd13be357-92ecf54a01bmr1090930985a.22.1783681637257; Fri, 10 Jul 2026 04:07:17 -0700 (PDT) From: Michael Bommarito To: devel@lists.libvirt.org Subject: [libvirt PATCH 4/4] tests: cover line-break rejection in DNS TXT and SRV records Date: Fri, 10 Jul 2026 07:07:01 -0400 Message-ID: <20260710110701.278146-5-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260710110701.278146-1-michael.bommarito@gmail.com> References: <20260710110701.278146-1-michael.bommarito@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-MailFrom: michael.bommarito@gmail.com X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation Message-ID-Hash: L7JKIQUMSY34XVFQ5QOMCGV2M5RDTTQC X-Message-ID-Hash: L7JKIQUMSY34XVFQ5QOMCGV2M5RDTTQC X-Mailman-Approved-At: Fri, 10 Jul 2026 11:09:19 +0000 X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1783682102112158500 Content-Type: text/plain; charset="utf-8" Add negative tests that feed XML numeric character references for LF ( ) and CR ( ) into the DNS TXT value and SRV domain/target attributes, covering both the network XML parse path and the update API. Literal newlines are insufficient because XML parsers normalize raw attribute whitespace to spaces; the numeric references are what survive to the configuration emitter. CVE-2026-61477 Signed-off-by: Michael Bommarito --- .../dns-txt-record-newline.xml | 1 + .../srv-record-target-newline.xml | 1 + tests/networkxml2xmlupdatetest.c | 12 ++++++++++++ .../nat-network-dns-srv-record-domain-newline.xml | 14 ++++++++++++++ .../nat-network-dns-srv-record-target-newline.xml | 14 ++++++++++++++ .../nat-network-dns-txt-record-newline.xml | 14 ++++++++++++++ tests/networkxmlconftest.c | 3 +++ 7 files changed, 59 insertions(+) create mode 100644 tests/networkxml2xmlupdatein/dns-txt-record-newline.xml create mode 100644 tests/networkxml2xmlupdatein/srv-record-target-newline.= xml create mode 100644 tests/networkxmlconfdata/nat-network-dns-srv-record-dom= ain-newline.xml create mode 100644 tests/networkxmlconfdata/nat-network-dns-srv-record-tar= get-newline.xml create mode 100644 tests/networkxmlconfdata/nat-network-dns-txt-record-new= line.xml diff --git a/tests/networkxml2xmlupdatein/dns-txt-record-newline.xml b/test= s/networkxml2xmlupdatein/dns-txt-record-newline.xml new file mode 100644 index 0000000000..13ed0408f4 --- /dev/null +++ b/tests/networkxml2xmlupdatein/dns-txt-record-newline.xml @@ -0,0 +1 @@ + diff --git a/tests/networkxml2xmlupdatein/srv-record-target-newline.xml b/t= ests/networkxml2xmlupdatein/srv-record-target-newline.xml new file mode 100644 index 0000000000..f29385d0e1 --- /dev/null +++ b/tests/networkxml2xmlupdatein/srv-record-target-newline.xml @@ -0,0 +1 @@ + diff --git a/tests/networkxml2xmlupdatetest.c b/tests/networkxml2xmlupdatet= est.c index b017922d94..35fdfed0ec 100644 --- a/tests/networkxml2xmlupdatetest.c +++ b/tests/networkxml2xmlupdatetest.c @@ -288,6 +288,10 @@ mymain(void) =20 =20 section =3D VIR_NETWORK_SECTION_DNS_TXT; + DO_TEST_FAIL("insert-dns-txt-record-newline", + "dns-txt-record-newline", + "nat-network-dns-txt-record", + VIR_NETWORK_UPDATE_COMMAND_ADD_FIRST); DO_TEST("insert-dns-txt-record", "dns-txt-record-snowman", "nat-network-dns-txt-record", @@ -311,6 +315,10 @@ mymain(void) "nat-network-dns-txt-record", "nat-network-dns-txt-modify-ok", VIR_NETWORK_UPDATE_COMMAND_MODIFY); + DO_TEST_FAIL("modify-dns-txt-record-newline", + "dns-txt-record-newline", + "nat-network-dns-txt-record", + VIR_NETWORK_UPDATE_COMMAND_MODIFY); DO_TEST_FAIL("modify-missing-dns-txt-record", "dns-txt-record-modify-fail", "nat-network-dns-txt-record", @@ -328,6 +336,10 @@ mymain(void) "nat-network", "nat-network-dns-srv-record", VIR_NETWORK_UPDATE_COMMAND_ADD_LAST); + DO_TEST_FAIL("append-srv-record-target-newline", + "srv-record-target-newline", + "nat-network", + VIR_NETWORK_UPDATE_COMMAND_ADD_LAST); DO_TEST_FAIL("add-existing-dns-srv-record", "srv-record", "nat-network-dns-srv-record", diff --git a/tests/networkxmlconfdata/nat-network-dns-srv-record-domain-new= line.xml b/tests/networkxmlconfdata/nat-network-dns-srv-record-domain-newli= ne.xml new file mode 100644 index 0000000000..2a1a5e4a89 --- /dev/null +++ b/tests/networkxmlconfdata/nat-network-dns-srv-record-domain-newline.xml @@ -0,0 +1,14 @@ + + default + 81ff0d90-c91e-6742-64da-4a736edb9a9b + + + + + + + + + + + diff --git a/tests/networkxmlconfdata/nat-network-dns-srv-record-target-new= line.xml b/tests/networkxmlconfdata/nat-network-dns-srv-record-target-newli= ne.xml new file mode 100644 index 0000000000..f3f722ab16 --- /dev/null +++ b/tests/networkxmlconfdata/nat-network-dns-srv-record-target-newline.xml @@ -0,0 +1,14 @@ + + default + 81ff0d90-c91e-6742-64da-4a736edb9a9b + + + + + + + + + + + diff --git a/tests/networkxmlconfdata/nat-network-dns-txt-record-newline.xm= l b/tests/networkxmlconfdata/nat-network-dns-txt-record-newline.xml new file mode 100644 index 0000000000..02408a1e36 --- /dev/null +++ b/tests/networkxmlconfdata/nat-network-dns-txt-record-newline.xml @@ -0,0 +1,14 @@ + + default + 81ff0d90-c91e-6742-64da-4a736edb9a9b + + + + + + + + + + + diff --git a/tests/networkxmlconftest.c b/tests/networkxmlconftest.c index 40eb3ffdb4..c0d3886a69 100644 --- a/tests/networkxmlconftest.c +++ b/tests/networkxmlconftest.c @@ -323,7 +323,10 @@ mymain(void) DO_TEST("netboot-proxy-network"); DO_TEST("netboot-tftp"); DO_TEST("nat-network-dns-txt-record"); + DO_TEST_PARSE_ERROR("nat-network-dns-txt-record-newline"); DO_TEST("nat-network-dns-srv-record"); + DO_TEST_PARSE_ERROR("nat-network-dns-srv-record-domain-newline"); + DO_TEST_PARSE_ERROR("nat-network-dns-srv-record-target-newline"); DO_TEST("nat-network-dns-srv-records"); DO_TEST("nat-network-dns-srv-record-minimal"); DO_TEST("nat-network-dns-hosts"); --=20 2.53.0