emanegentransportxml not working with libxml2 2.7.8.dfsg-5.1ubuntu4.7

[sgalgano]

Reported on mailing list by Hasnain Lakhani:

Our tests started failing on Friday. We use EMANE 0.7.4.

Debugging showed that EMANE uses external parameters entities in the XML
files; specifically the DTD links (I believe). We were getting errors on
files that worked perfectly fine previously. The errors would be of the
following form:

validity error : No declaration for element param
validity error : No declaration for attribute name of element param
validity error : No declaration for attribute value of element param

libxml2 had a security update on Thursday:

libxml2 (2.7.8.dfsg-5.1ubuntu4.7) precise-security; urgency=medium

• SECURITY UPDATE: resource exhaustion via external parameter entities
  • parser.c: do not fetch external parameter entities.
  • https://git.gnome.org/browse/libxml2/commit/?id=9cd1c3cfbd32655d60572c0a413e017260c854df
  • CVE-2014-0191
    -- Marc Deslauriers Thu, 08 May 2014 14:30:38 -0400

After downgrading libxml down to 2.7.8.dfsg-5.1ubuntu4.6 we noticed that
emanegentransportxml works fine again.

This behaviour should be fixed so that it works again with the latest
libxml2. I'll be happy to provide further information if needed

[sgalgano]

Issue present in 0.8.1 and 0.9.1.

The issue is related to changes in the way DTDs with external entities are handled. There is a sanity check in emanegentransportxml that validates the generated XML against the DTD. This is where the issue is occurring:

515:  my $dtdY = XML::LibXML::Dtd->new("", "$dtdPath"."$dtdFile");
516:  $document->validate($dtdY);

Now is probably a good time to replace the script with a python equivalent using lxml.etree. That has been the plan for a while. The current script is difficult to maintain and adds unnecessary perl packages to the emane installation dependencies.

[sgalgano]

Pull requested for merge with develop.

[sgalgano]

Merged into develop 848848b