From nobody Tue Sep 22 04:10:28 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1783681968; cv=none; d=zohomail.com; s=zohoarc; b=SxCyDAEZdMLsQnqnVRImlvL41rfdRr/slBfUZdHIDBLUoMr+aAh2gRm+UGZSkAl0uOnI0FR6ZquJwo/R9BjkIGfNmwr8zzUfUXowCb605I4JcTPljLzcaOEKKNM7tO+Y749FVCuSEavSOGrlsE3zaXqwCnNqu8R5E87a3GsN9Hk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783681968; h=Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=B5CM40+G9KEG4/9MqpDT7Zt9s4MD02UtZ2dAMzla02w=; b=FMsRw0coY/0SpOpqMwvxb3EZzaRvxv/QvUI4wtNVsM7vRqOiigsWenQKP5vwCQB8ExcL4Av4dWMWUSx6hT4Wk7zjJi/0ItyaJZjEBfHnaMPwlFli5r5JYOKGdOygMpg3RDHmA94cEUig4wnuXWlQz3Sd7v0FDh5ffBUXO5uZOFA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1783681968678838.7922316127355; Fri, 10 Jul 2026 04:12:48 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id A44BE41887; Fri, 10 Jul 2026 07:12:47 -0400 (EDT) Received: from [172.19.199.10] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 6271741DFF; Fri, 10 Jul 2026 07:09:38 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 5B5A341AE0; Fri, 10 Jul 2026 07:07:15 -0400 (EDT) Received: from mail-qk1-x735.google.com (mail-qk1-x735.google.com [IPv6:2607:f8b0:4864:20::735]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id C981C41B65 for ; Fri, 10 Jul 2026 07:07:14 -0400 (EDT) Received: by mail-qk1-x735.google.com with SMTP id af79cd13be357-92e5c92c389so35791385a.3 for ; Fri, 10 Jul 2026 04:07:14 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id af79cd13be357-92ee5cf7ab2sm165527185a.30.2026.07.10.04.07.12 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 10 Jul 2026 04:07:13 -0700 (PDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783681634; x=1784286434; darn=lists.libvirt.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=B5CM40+G9KEG4/9MqpDT7Zt9s4MD02UtZ2dAMzla02w=; b=C+4WdyaljxDM0tFhqlFPM4MiuU6kohhRUdTGyhoFaDpzOIJUGzP24UAmkDcn+sWyWW B8LyGPOoc5kabtRzDkztqf/ekigldnMrRG1pjs36peIXoCYDn747HxoQXSlLL676EYF9 WN5Ib9+zRQ2bMP2kre23AuPqTTnRgWwG76iA4LSG1I+4xmRV/JAq0Xdq/90daWRS7ycl TD6QfuMexU/npzt0jHpVBoNtQ2Vhrx910+0JW7zAXOSogngYzZoCZ16YyvDRAWETg/nI fyamiTf5kjxmR0ebR8NT2bjiLzjzXTJo13SOA5aNCj2D8gyFvzi+gGJBVcBzLotkAHfr ONWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783681634; x=1784286434; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=B5CM40+G9KEG4/9MqpDT7Zt9s4MD02UtZ2dAMzla02w=; b=dZK4rLVFA1CaEOdFJbbqrH020j2KSLUFezuc6FjTf3oOSANUrz0L5btLNi1DqqUNSb zjvVlv8NSpL58Z3ptM/YkQ4KtbOHpjah2K7IFXlPpAE6H4OnXiD6sFB74BcKfjyNoXto sLFa9hUKUKMGBBJz8t/n04PmU6a1FvmGZvlvk433xsUQn+YBH6UBsCVWCMj/EHc4W3HG iyiDTdt58ayZDnzLhAhI9X73mi4q8GN1bD2qEZwhAJubgzPfN8bGfGX0Trjco+pnoGNl xDPUaq2BmmzKzLB3SdFl1xgJRBCluLAruLP2gmA17tJiLJGWdx2ertDrLpLA/vUWB8yX Zcog== X-Gm-Message-State: AOJu0YyrdiU0QeNjzGr8ZD4gR9hOTwPvEdpcKXS6pDNWwtns87DcE4vR 6Yhi/q/B5hrTdYJTu6Pabo0W12S+YDJMbRViXGpnVkfq4ziDfn4HoYKxxZhRhdhOnsc= X-Gm-Gg: AfdE7cn0NdDFsrbgC+vudtvCLh+Egg+JQFUps7SYr9Jn7EVFfatlYSHBXyhj29HTuS3 XoM277bHiXL+5wB8G5T3aabNZWwYw8UGJJ+0tJ/Bi5Fcw4CbBSkYzaxycAOt2rs2EKJpbH4KJGJ DcmdnOdxA2DfvBr5Nynh7j8eYOqjousGLKcOViqOsl7Rv7hYth+uT9cHOHt/747smkPiiSEJ2MR murVwGD3MTrcbKh51VnMmTsfZ/A/ZZsEM5FZ6QA4d7LAum8RQSXt4IR1k6ng2z1SxA2OzRldiv5 3EnzSVb/zYd9pTEI6uJle9+9P/aNnFodHLsPI3rzvEGnijAzMXSOXaZtdV5sJovRGM7+nr/dV68 Q4a3TFQkU9SKPOMDE7GDtGhalAvo+bdEcY75rSEecT0gk0HDLlFosVu3puokN9baL+sxIs8Oqqd 3giPqgBRdIb5MShfdskZdk/PxRasq096e8JP1sxjM3z0sFcZDKKGtXGanW4+d/J/5Jld5cgugAD ZCtBAJtwJPidKMArJ9ctWOepEsmMpBM X-Received: by 2002:a05:620a:a012:b0:92e:e6e1:d083 with SMTP id af79cd13be357-92ee6e1d934mr172167085a.52.1783681634086; Fri, 10 Jul 2026 04:07:14 -0700 (PDT) From: Michael Bommarito To: devel@lists.libvirt.org Subject: [libvirt PATCH 2/4] conf: reject line breaks in DNS SRV domain and target Date: Fri, 10 Jul 2026 07:06:59 -0400 Message-ID: <20260710110701.278146-3-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260710110701.278146-1-michael.bommarito@gmail.com> References: <20260710110701.278146-1-michael.bommarito@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-MailFrom: michael.bommarito@gmail.com X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation Message-ID-Hash: D47QDB33I2XIAF2S5G7KA7MDSGC3SMKV X-Message-ID-Hash: D47QDB33I2XIAF2S5G7KA7MDSGC3SMKV X-Mailman-Approved-At: Fri, 10 Jul 2026 11:09:19 +0000 X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1783681969815158500 Content-Type: text/plain; charset="utf-8" The domain and target attributes flow through the same dnsmasq configuration emitter as TXT values, written into srv-host=3D lines. Like the TXT value they accept XML numeric character references for LF and CR and are not otherwise constrained, unlike service and protocol which already have allow-lists. An embedded line break ends the srv-host=3D directive and begins a new one. Reject LF and CR in the SRV domain and target during XML parsing, reusing the helper added for TXT values. CVE-2026-61477 Fixes: 6612d1adb794 ("network: fix problems with SRV records") Signed-off-by: Michael Bommarito --- src/conf/network_conf.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c index 307ab0ae24..8eba1321d6 100644 --- a/src/conf/network_conf.c +++ b/src/conf/network_conf.c @@ -792,6 +792,10 @@ virNetworkDNSSrvDefParseXML(const char *networkName, def->domain =3D virXMLPropString(node, "domain"); def->target =3D virXMLPropString(node, "target"); =20 + if (virNetworkDNSDefCheckLineBreaks("SRV", "domain", def->domain) < 0 = || + virNetworkDNSDefCheckLineBreaks("SRV", "target", def->target) < 0) + goto error; + ret =3D virXPathUInt("string(./@port)", ctxt, &def->port); if (ret >=3D 0 && !def->target) { virReportError(VIR_ERR_XML_DETAIL, --=20 2.53.0