Bug 1003909
Summary: | netlabelctl does not check correct address format | ||||||
---|---|---|---|---|---|---|---|
Product: | Red Hat Enterprise Linux 7 | Reporter: | Ondrej Moriš <omoris> | ||||
Component: | netlabel_tools | Assignee: | Paul Moore <pmoore> | ||||
Status: | CLOSED CURRENTRELEASE | QA Contact: | Ondrej Moriš <omoris> | ||||
Severity: | low | Docs Contact: | |||||
Priority: | low | ||||||
Version: | 7.0 | ||||||
Target Milestone: | beta | ||||||
Target Release: | 7.0 | ||||||
Hardware: | All | ||||||
OS: | Linux | ||||||
Whiteboard: | |||||||
Fixed In Version: | netlabel_tools-0.20-1.el7 | Doc Type: | Bug Fix | ||||
Doc Text: | Story Points: | --- | |||||
Clone Of: | Environment: | ||||||
Last Closed: | 2014-06-13 10:36:28 UTC | Type: | Bug | ||||
Regression: | --- | Mount Type: | --- | ||||
Documentation: | --- | CRM: | |||||
Verified Versions: | Category: | --- | |||||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
Cloudforms Team: | --- | Target Upstream Version: | |||||
Embargoed: | |||||||
Attachments: |
|
Description
Ondrej Moriš
2013-09-03 13:40:14 UTC
The issue appears to be in netlabelctl's nlctl_addr_parse() function where it relies on atoi() to convert the mask to an integer value (hence the '0' mask value in the example above). We should add some extra checking to verify that the mask is 1) a number and 2) between 0 and 32 inclusive. We also need to do something similar for IPv6 and the network addresses as well. I verified the kernel has the necessary input checking in place, the issue is solely in how netlabelctl converts the user input into a network mask. Created attachment 816284 [details]
Proposed patch which corrects the problem
Patch committed upstream: commit 2a084f9d79945b1d6d4b5abf7e4d19f1588daaaa Author: Paul Moore <pmoore> Date: Fri Oct 25 16:46:15 2013 -0400 netlabelctl: add additional validation code to the network address parser It is possible to use network masks with non-integer values or integer values greater than the size of the network address, this patch fixes this. Signed-off-by: Paul Moore <pmoore> Using the patch provided above the problem appears to be fixed for me: # netlabelctl -p map list Configured NetLabel domain mappings (1) domain: DEFAULT protocol: UNLABELED # netlabelctl -p map add domain:ping_t address:192.168.1.200/100 protocol:unlbl netlabelctl: error, invalid argument or parameter # netlabelctl -p map add domain:ping_t address:192.168.1.200/xyz protocol:unlbl netlabelctl: error, invalid argument or parameter # netlabelctl -p map list Configured NetLabel domain mappings (1) domain: DEFAULT protocol: UNLABELED # netlabelctl -p map add domain:ping_t address:192.168.1.200/24 protocol:unlbl # netlabelctl -p map add domain:ping_t address:192.168.1.201/32 protocol:unlbl # netlabelctl -p map add domain:ping_t address:192.168.1.202 protocol:unlbl # netlabelctl -p map list Configured NetLabel domain mappings (2) domain: "ping_t" address: 192.168.1.201/32 protocol: UNLABELED address: 192.168.1.202/32 protocol: UNLABELED address: 192.168.1.0/24 protocol: UNLABELED domain: DEFAULT protocol: UNLABELED Great, thanks Paul, I have verified that it works fine now: netlabel_tools-0.20-1.el7 # netlabelctl map add domain:ping_t address:192.168.1.200/100 protocol:unlbl netlabelctl: error, invalid argument or parameter # netlabelctl map add domain:ping_t address:192.168.1.200/xyz protocol:unlbl netlabelctl: error, invalid argument or parameter # netlabelctl -p map list Configured NetLabel domain mappings (1) domain: DEFAULT protocol: UNLABELED I am setting netlabel_tools-0.20-1.el7 into "Fixed in Version" field. This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request. |