NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2026-09-03 20:53:04 -05:00
Code Issues Packages Projects Releases Wiki Activity

tests: cover line-break rejection in DNS TXT and SRV records

Browse Source 
Add negative tests that feed XML numeric character references for LF
(
) and CR (
) into the DNS TXT value and SRV domain/target
attributes, covering both the network XML parse path and the update
API. Literal newlines are insufficient because XML parsers normalize
raw attribute whitespace to spaces; the numeric references are what
survive to the configuration emitter.

CVE-2026-61477

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
This commit is contained in:
Michael Bommarito
2026-07-16 13:04:45 +01:00
committed by Daniel P. Berrangé
parent cb8974b923
commit 3cfc77963b
8 changed files with 69 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/networkxml2xmlupdatein/dns-txt-record-newline.xml
+1
View File
@@ -0,0 +1 @@
<txt name='example' value='example value&#10;dhcp-script=/tmp/payload'/>
tests/networkxml2xmlupdatein/srv-record-target-newline.xml
+1
View File
@@ -0,0 +1 @@
<srv service='ldap' protocol='tcp' target='server.example.com&#10;dhcp-script=/tmp/payload'/>
tests/networkxml2xmlupdatetest.c
+12
View File
@@ -288,6 +288,10 @@ mymain(void)
section = VIR_NETWORK_SECTION_DNS_TXT;
DO_TEST_FAIL("insert-dns-txt-record-newline",
"dns-txt-record-newline",
"nat-network-dns-txt-record",
VIR_NETWORK_UPDATE_COMMAND_ADD_FIRST);
DO_TEST("insert-dns-txt-record",
"dns-txt-record-snowman",
"nat-network-dns-txt-record",
@@ -311,6 +315,10 @@ mymain(void)
"nat-network-dns-txt-record",
"nat-network-dns-txt-modify-ok",
VIR_NETWORK_UPDATE_COMMAND_MODIFY);
DO_TEST_FAIL("modify-dns-txt-record-newline",
"dns-txt-record-newline",
"nat-network-dns-txt-record",
VIR_NETWORK_UPDATE_COMMAND_MODIFY);
DO_TEST_FAIL("modify-missing-dns-txt-record",
"dns-txt-record-modify-fail",
"nat-network-dns-txt-record",
@@ -328,6 +336,10 @@ mymain(void)
"nat-network",
"nat-network-dns-srv-record",
VIR_NETWORK_UPDATE_COMMAND_ADD_LAST);
DO_TEST_FAIL("append-srv-record-target-newline",
"srv-record-target-newline",
"nat-network",
VIR_NETWORK_UPDATE_COMMAND_ADD_LAST);
DO_TEST_FAIL("add-existing-dns-srv-record",
"srv-record",
"nat-network-dns-srv-record",
tests/networkxmlconfdata/nat-network-dns-srv-record-domain-newline.xml
+14
View File
@@ -0,0 +1,14 @@
<network>
<name>default</name>
<uuid>81ff0d90-c91e-6742-64da-4a736edb9a9b</uuid>
<forward dev='eth1' mode='nat'/>
<bridge name='virbr0' stp='on' delay='0'/>
<dns>
<srv service='ldap' protocol='tcp' domain='example.com&#13;dhcp-script=/tmp/payload' target='server.example.com'/>
</dns>
<ip address='192.168.122.1' netmask='255.255.255.0'>
<dhcp>
<range start='192.168.122.2' end='192.168.122.254'/>
</dhcp>
</ip>
</network>
tests/networkxmlconfdata/nat-network-dns-srv-record-target-newline.xml
+14
View File
@@ -0,0 +1,14 @@
<network>
<name>default</name>
<uuid>81ff0d90-c91e-6742-64da-4a736edb9a9b</uuid>
<forward dev='eth1' mode='nat'/>
<bridge name='virbr0' stp='on' delay='0'/>
<dns>
<srv service='ldap' protocol='tcp' domain='example.com' target='server.example.com&#10;dhcp-script=/tmp/payload'/>
</dns>
<ip address='192.168.122.1' netmask='255.255.255.0'>
<dhcp>
<range start='192.168.122.2' end='192.168.122.254'/>
</dhcp>
</ip>
</network>
tests/networkxmlconfdata/nat-network-dns-txt-record-newline.xml
+14
View File
@@ -0,0 +1,14 @@
<network>
<name>default</name>
<uuid>81ff0d90-c91e-6742-64da-4a736edb9a9b</uuid>
<forward dev='eth1' mode='nat'/>
<bridge name='virbr0' stp='on' delay='0'/>
<dns>
<txt name='example' value='example value&#10;dhcp-script=/tmp/payload'/>
</dns>
<ip address='192.168.122.1' netmask='255.255.255.0'>
<dhcp>
<range start='192.168.122.2' end='192.168.122.254'/>
</dhcp>
</ip>
</network>
tests/networkxmlconftest.c
+3
View File
@@ -323,7 +323,10 @@ mymain(void)
DO_TEST("netboot-proxy-network");
DO_TEST("netboot-tftp");
DO_TEST("nat-network-dns-txt-record");
DO_TEST_PARSE_ERROR("nat-network-dns-txt-record-newline");
DO_TEST("nat-network-dns-srv-record");
DO_TEST_PARSE_ERROR("nat-network-dns-srv-record-domain-newline");
DO_TEST_PARSE_ERROR("nat-network-dns-srv-record-target-newline");
DO_TEST("nat-network-dns-srv-records");
DO_TEST("nat-network-dns-srv-record-minimal");
DO_TEST("nat-network-dns-hosts");
tests/virschematest.c
+10 -1
View File
@@ -301,9 +301,18 @@ static const struct testSchemaEntry schemaInterface[] = {
{ .dir = "tests/interfaceschemadata" },
};
/* skip tests with completely broken XML */
static const char *skip_networkxmlconfdata[] = {
"nat-network-dns-srv-record-domain-newline.xml",
"nat-network-dns-srv-record-target-newline.xml",
"nat-network-dns-txt-recor-record-newline.xml",
NULL,
};
static const struct testSchemaEntry schemaNetwork[] = {
{ .dir = "src/network" },
{ .dir = "tests/networkxmlconfdata" },
{ .dir = "tests/networkxmlconfdata",
.skip = skip_networkxmlconfdata },
{ .dir = "examples/xml/test/",
.dirRegex = "testnet.*" },
{ .dir = "tests/networkxml2xmlupdateout" },