From nobody Tue Sep 22 15:34:16 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1783682024; cv=none; d=zohomail.com; s=zohoarc; b=CCxZzkUfEajjO4B2VTiyJgrFKOIYACQDSO2TR98i8mgzQAsqBw6K6dbKKnIer5IWSMoq46ivVUEtzxN4O6ChUAWBkJqWdCMIph9cd6vEktoNNliS53+x02bXYXXCpqdd3eO+DPGTgEVg2ti12kmXD8XsskSWp8xdcOvQ8IfucGk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783682024; h=Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=k4X+zJ1/Nru3eEKGe2tkfLjmciEN5/eyAS9aG3J5sE8=; b=fr5hPb/Ubrzm6ZbL1SFmY51cAzuZ7HFYibNpSzvAj9ahhKA0fFSlqS0ZHS+WWVAtQ7rPfroayk5pMmktOAS0Ld0qm6rw3S2TBHPa4b7uFrSRkEHPguR37Zg7YXAo9al+EHTJBOtABjPMrY4L45VNcyhQjVSYstjRviNnd+FstpU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1783682024413657.0489560792939; Fri, 10 Jul 2026 04:13:44 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 146FD3F956; Fri, 10 Jul 2026 07:13:43 -0400 (EDT) Received: from [172.19.199.10] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id BDE0641E43; Fri, 10 Jul 2026 07:09:42 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 2528141AE0; Fri, 10 Jul 2026 07:07:17 -0400 (EDT) Received: from mail-qk1-x729.google.com (mail-qk1-x729.google.com [IPv6:2607:f8b0:4864:20::729]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 6A35241B70 for ; Fri, 10 Jul 2026 07:07:16 -0400 (EDT) Received: by mail-qk1-x729.google.com with SMTP id af79cd13be357-92e4fd65b2bso35910685a.0 for ; Fri, 10 Jul 2026 04:07:16 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id af79cd13be357-92ee5cf7ab2sm165527185a.30.2026.07.10.04.07.14 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 10 Jul 2026 04:07:14 -0700 (PDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783681636; x=1784286436; darn=lists.libvirt.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=k4X+zJ1/Nru3eEKGe2tkfLjmciEN5/eyAS9aG3J5sE8=; b=UJ/Wnsg8JgdM8gemGf7Y+Ok0+9Dijwh8aOQVA3nye+jHcZ3yV3OKqDMQE5O3B7DYef yx8aZ2Jy9sVPt6YFvZIyThVsuzPaVuHeetNsb746Hn7q5HZmYIgS72zDDJS77AK8NnnR WclQBkbHDKWSVIMpSODZ6ttXTaYshn+2XuQL6hLpUIMjGLWXVi6Lku8RsvXIWhPaWOoE 7sknhdirTSSRG2ytz5exUvr6/AYaE5kCjbE9azhIwM9kOALGT1DRLK0bg4zh5JxKfktZ Lc5Y5ElyEL1OcyEND+FXBqQ7yLaz/aRCrgFfR5VmgGAPzYXh8sKWzPlQZGaFpmKiZH8j /JgQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783681636; x=1784286436; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=k4X+zJ1/Nru3eEKGe2tkfLjmciEN5/eyAS9aG3J5sE8=; b=XnUjl15zr9mk/2mbnOpE+B58J482CreY6FEZdGK4M2IdNQXzshem7/AtC9DAhJpQKQ R5c9Q5ZyFzlI61GpnzSeN+9oQs1OhvQAe2r2HnlKFtm87hax/MCcWg7/L/xhpO443AA/ fvBx7+fPTTobfICcZx7/p9krk3P0tENIIls6ZEggW2LFlHuK+xhHSao/D63gCuWlC0YT WbKZkVYm64EV8UAD+Y2TQGcc+10OZvU9DGUuQDzM/6lySWujT07b9UHipa7v90qidc6Q NBzHWhn4yXMWT11TQyOVdqVoLBibTT9Q/znPcV+lgYN3X+cSPb6Ix0CgI7dUANOPifGR ECng== X-Gm-Message-State: AOJu0YwV43AV1KHpzKxseoHzy6Qs/cmHxzhhfYIx9fn8Lco6Om1T171I /ht52EeSaw1XuZyY4ErGu686c2CqgAfTrakmqwwW1T9+iB922ajtpap2pBy+kBMf8MI= X-Gm-Gg: AfdE7cn8z7cToJS34RNa+otR2Z3rSvIRYUTzjv89RhDBog/Logt2+qF8GKNg8rnxsHv sV2M8PQ+dOEKcIejK2c1kDLQRK7VRuWMO8S54Vl9BjsYGRmUyjMw7qGW1nIEJN4Cd9DljKiZ6V+ ulM2qbT9gd8VEi4DZCBeHl0gUoZQs95Ec1TI4AnWWDsK/hEwACko336UbPXefEHI9kxIx9hdTjm Dg+WxBCMO+i+XjYQU7QoLmjyBRQmLCEccVnRcoy1hUt7pVLUQcjgvifdHAm1eviD2ACwf3wMWCC Ohvts1pDAXTCX7A2sQQ2hyahfPQs9m2rsa5hcSCvb9rfTinc5T5GX0T6DdjJg30MkJNrPwjTlfR 1cPN5bW2PiM5WFAsX2WNaGWPfj2/uFdILMRJBaMVhzd6yaUIl/QotAuiTfxUfRglTm16usnzDWK IBhyrE8PlI6j9UV4jYQXHnokY99YWEdqsi0oYm8GtyM8CKvrAYOddao+ZiKUlb/l+nwoZ/XwG2O x4W9oy+h/wT775LVT012E9JWIAQaPBD X-Received: by 2002:a05:620a:3195:b0:915:68dd:1eff with SMTP id af79cd13be357-92ecf68c95amr1284505285a.50.1783681635647; Fri, 10 Jul 2026 04:07:15 -0700 (PDT) From: Michael Bommarito To: devel@lists.libvirt.org Subject: [libvirt PATCH 3/4] network: reject line breaks before writing dnsmasq DNS config Date: Fri, 10 Jul 2026 07:07:00 -0400 Message-ID: <20260710110701.278146-4-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260710110701.278146-1-michael.bommarito@gmail.com> References: <20260710110701.278146-1-michael.bommarito@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-MailFrom: michael.bommarito@gmail.com X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation Message-ID-Hash: OXUCIP5YRKPOYDC5CBHBIOHOAXI55VUH X-Message-ID-Hash: OXUCIP5YRKPOYDC5CBHBIOHOAXI55VUH X-Mailman-Approved-At: Fri, 10 Jul 2026 11:09:19 +0000 X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1783682025547158500 Content-Type: text/plain; charset="utf-8" The parser now rejects line breaks in typed DNS TXT and SRV fields, but the dnsmasq configuration emitter is the actual trust boundary: any future parser gap, or a value reaching the emitter by another path, would again let a typed DNS field inject an arbitrary dnsmasq directive. Add a defensive check in networkDnsmasqConfContents() that rejects LF and CR in every typed DNS string immediately before it is written to the line-based configuration file. This sits behind the parser checks and keeps the emitter correct on its own. The raw namespace is intentionally left untouched: it is the documented escape hatch for arbitrary dnsmasq options, and sanitizing it would be a separate, deliberate behavior change. CVE-2026-61477 Fixes: 8b32c80df089 ("network: put dnsmasq parameters in conf-file instead = of command line") Signed-off-by: Michael Bommarito --- src/network/bridge_driver.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index 4dc3e5424b..6ebdc27e76 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -64,6 +64,7 @@ #include "virhook.h" #include "virjson.h" #include "virnetworkportdef.h" +#include "virstring.h" #include "virutil.h" #include "virsystemd.h" #include "netdev_bandwidth_conf.h" @@ -119,6 +120,22 @@ networkDnsmasqDefNamespaceFree(void *nsdata) G_DEFINE_AUTOPTR_CLEANUP_FUNC(networkDnsmasqXmlNsDef, networkDnsmasqDefNam= espaceFree); =20 =20 +static int +networkDnsmasqConfCheckLineBreaks(const char *record, + const char *field, + const char *value) +{ + if (virStringHasChars(value, "\r\n")) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("DNS %1$s record %2$s must not contain line break= s"), + record, field); + return -1; + } + + return 0; +} + + static int networkDnsmasqDefNamespaceParseOptions(networkDnsmasqXmlNsDef *nsdef, xmlXPathContextPtr ctxt) @@ -1300,6 +1317,10 @@ networkDnsmasqConfContents(virNetworkObj *obj, =20 if (wantDNS) { for (i =3D 0; i < dns->ntxts; i++) { + if (networkDnsmasqConfCheckLineBreaks("TXT", "name", dns->txts= [i].name) < 0 || + networkDnsmasqConfCheckLineBreaks("TXT", "value", dns->txt= s[i].value) < 0) + return -1; + virBufferAsprintf(&configbuf, "txt-record=3D%s,%s\n", dns->txts[i].name, dns->txts[i].value); @@ -1321,6 +1342,13 @@ networkDnsmasqConfContents(virNetworkObj *obj, def->name); return -1; } + + if (networkDnsmasqConfCheckLineBreaks("SRV", "service", dns->s= rvs[i].service) < 0 || + networkDnsmasqConfCheckLineBreaks("SRV", "protocol", dns->= srvs[i].protocol) < 0 || + networkDnsmasqConfCheckLineBreaks("SRV", "domain", dns->sr= vs[i].domain) < 0 || + networkDnsmasqConfCheckLineBreaks("SRV", "target", dns->sr= vs[i].target) < 0) + return -1; + /* RFC2782 requires that service and protocol be preceded by * an underscore. */ --=20 2.53.0