Bug 1003909

Summary: netlabelctl does not check correct address format
Product: Red Hat Enterprise Linux 7 Reporter: Ondrej Moriš <omoris>
Component: netlabel_toolsAssignee: Paul Moore <pmoore>
Status: CLOSED CURRENTRELEASE QA Contact: Ondrej Moriš <omoris>
Severity: low Docs Contact:
Priority: low    
Version: 7.0   
Target Milestone: beta   
Target Release: 7.0   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: netlabel_tools-0.20-1.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-06-13 10:36:28 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Proposed patch which corrects the problem none

Description Ondrej Moriš 2013-09-03 13:40:14 UTC 
Description of problem:

Netlabelctl does allow to add mapping with malformed address prefix. It should check that prefix is correct and not out of range. It is also possible to use non-numeric values as prefix.

Version-Release number of selected component (if applicable):

netlabel_tools-0.20-0.el7

How reproducible:

100%

Steps to Reproduce:

1. netlabelctl map add domain:ping_t address:192.168.1.200/100 protocol:unlbl
2. netlabelctl map add domain:ping_t address:192.168.1.200/xyz protocol:unlbl

Actual results:

1. domain:"ping_t",address:192.168.1.200/32,protocol:UNLABELED     
   domain:DEFAULT,UNLABELED
2. domain:"ping_t",address:0.0.0.0/0,protocol:UNLABELED 
   domain:DEFAULT,UNLABELED

Expected results:

netlabelctl: error, invalid argument or parameter

Additional info:

N/A
Comment 1 Paul Moore 2013-10-25 15:29:34 UTC 
The issue appears to be in netlabelctl's nlctl_addr_parse() function where it relies on atoi() to convert the mask to an integer value (hence the '0' mask value in the example above).  We should add some extra checking to verify that the mask is 1) a number and 2) between 0 and 32 inclusive.  We also need to do something similar for IPv6 and the network addresses as well.

I verified the kernel has the necessary input checking in place, the issue is solely in how netlabelctl converts the user input into a network mask.
Comment 2 Paul Moore 2013-10-25 21:52:54 UTC 
Created attachment 816284 [details]
Proposed patch which corrects the problem
Comment 4 Paul Moore 2013-10-25 21:56:54 UTC 
Patch committed upstream:

commit 2a084f9d79945b1d6d4b5abf7e4d19f1588daaaa
Author: Paul Moore <pmoore>
Date:   Fri Oct 25 16:46:15 2013 -0400

    netlabelctl: add additional validation code to the network address parser
    
    It is possible to use network masks with non-integer values or integer
    values greater than the size of the network address, this patch fixes
    this.
    
    Signed-off-by: Paul Moore <pmoore>
Comment 5 Paul Moore 2013-10-25 21:58:42 UTC 
Using the patch provided above the problem appears to be fixed for me:

# netlabelctl -p map list
Configured NetLabel domain mappings (1)
 domain: DEFAULT
   protocol: UNLABELED
# netlabelctl -p map add domain:ping_t address:192.168.1.200/100 protocol:unlbl
netlabelctl: error, invalid argument or parameter
# netlabelctl -p map add domain:ping_t address:192.168.1.200/xyz protocol:unlbl
netlabelctl: error, invalid argument or parameter
# netlabelctl -p map list
Configured NetLabel domain mappings (1)
 domain: DEFAULT
   protocol: UNLABELED
# netlabelctl -p map add domain:ping_t address:192.168.1.200/24 protocol:unlbl
# netlabelctl -p map add domain:ping_t address:192.168.1.201/32 protocol:unlbl
# netlabelctl -p map add domain:ping_t address:192.168.1.202 protocol:unlbl
# netlabelctl -p map list
Configured NetLabel domain mappings (2)
 domain: "ping_t"
   address: 192.168.1.201/32
    protocol: UNLABELED
   address: 192.168.1.202/32
    protocol: UNLABELED
   address: 192.168.1.0/24
    protocol: UNLABELED
 domain: DEFAULT
   protocol: UNLABELED
Comment 9 Ondrej Moriš 2013-12-09 12:19:48 UTC 
Great, thanks Paul, I have verified that it works fine now:

netlabel_tools-0.20-1.el7

# netlabelctl map add domain:ping_t address:192.168.1.200/100 protocol:unlbl
netlabelctl: error, invalid argument or parameter
# netlabelctl map add domain:ping_t address:192.168.1.200/xyz protocol:unlbl
netlabelctl: error, invalid argument or parameter
# netlabelctl -p map list
Configured NetLabel domain mappings (1)
 domain: DEFAULT
   protocol: UNLABELED

I am setting netlabel_tools-0.20-1.el7 into "Fixed in Version" field.
Comment 10 Ludek Smid 2014-06-13 10:36:28 UTC 
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.