RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1003909 - netlabelctl does not check correct address format
Summary: netlabelctl does not check correct address format
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: netlabel_tools
Version: 7.0
Hardware: All
OS: Linux
low
low
Target Milestone: beta
: 7.0
Assignee: Paul Moore
QA Contact: Ondrej Moriš
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-09-03 13:40 UTC by Ondrej Moriš
Modified: 2014-06-18 05:27 UTC (History)
0 users

Fixed In Version: netlabel_tools-0.20-1.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-06-13 10:36:28 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
Proposed patch which corrects the problem (2.28 KB, patch)
2013-10-25 21:52 UTC, Paul Moore 		no flags Details | Diff
View All

Description Ondrej Moriš 2013-09-03 13:40:14 UTC 
Description of problem:

Netlabelctl does allow to add mapping with malformed address prefix. It should check that prefix is correct and not out of range. It is also possible to use non-numeric values as prefix.

Version-Release number of selected component (if applicable):

netlabel_tools-0.20-0.el7

How reproducible:

100%

Steps to Reproduce:

1. netlabelctl map add domain:ping_t address:192.168.1.200/100 protocol:unlbl
2. netlabelctl map add domain:ping_t address:192.168.1.200/xyz protocol:unlbl

Actual results:

1. domain:"ping_t",address:192.168.1.200/32,protocol:UNLABELED     
   domain:DEFAULT,UNLABELED
2. domain:"ping_t",address:0.0.0.0/0,protocol:UNLABELED 
   domain:DEFAULT,UNLABELED

Expected results:

netlabelctl: error, invalid argument or parameter

Additional info:

N/A
Comment 1 Paul Moore 2013-10-25 15:29:34 UTC 
The issue appears to be in netlabelctl's nlctl_addr_parse() function where it relies on atoi() to convert the mask to an integer value (hence the '0' mask value in the example above).  We should add some extra checking to verify that the mask is 1) a number and 2) between 0 and 32 inclusive.  We also need to do something similar for IPv6 and the network addresses as well.

I verified the kernel has the necessary input checking in place, the issue is solely in how netlabelctl converts the user input into a network mask.
Comment 2 Paul Moore 2013-10-25 21:52:54 UTC 
Created attachment 816284 [details]
Proposed patch which corrects the problem
Comment 4 Paul Moore 2013-10-25 21:56:54 UTC 
Patch committed upstream:

commit 2a084f9d79945b1d6d4b5abf7e4d19f1588daaaa
Author: Paul Moore <pmoore>
Date:   Fri Oct 25 16:46:15 2013 -0400

    netlabelctl: add additional validation code to the network address parser
    
    It is possible to use network masks with non-integer values or integer
    values greater than the size of the network address, this patch fixes
    this.
    
    Signed-off-by: Paul Moore <pmoore>
Comment 5 Paul Moore 2013-10-25 21:58:42 UTC 
Using the patch provided above the problem appears to be fixed for me:

# netlabelctl -p map list
Configured NetLabel domain mappings (1)
 domain: DEFAULT
   protocol: UNLABELED
# netlabelctl -p map add domain:ping_t address:192.168.1.200/100 protocol:unlbl
netlabelctl: error, invalid argument or parameter
# netlabelctl -p map add domain:ping_t address:192.168.1.200/xyz protocol:unlbl
netlabelctl: error, invalid argument or parameter
# netlabelctl -p map list
Configured NetLabel domain mappings (1)
 domain: DEFAULT
   protocol: UNLABELED
# netlabelctl -p map add domain:ping_t address:192.168.1.200/24 protocol:unlbl
# netlabelctl -p map add domain:ping_t address:192.168.1.201/32 protocol:unlbl
# netlabelctl -p map add domain:ping_t address:192.168.1.202 protocol:unlbl
# netlabelctl -p map list
Configured NetLabel domain mappings (2)
 domain: "ping_t"
   address: 192.168.1.201/32
    protocol: UNLABELED
   address: 192.168.1.202/32
    protocol: UNLABELED
   address: 192.168.1.0/24
    protocol: UNLABELED
 domain: DEFAULT
   protocol: UNLABELED
Comment 9 Ondrej Moriš 2013-12-09 12:19:48 UTC 
Great, thanks Paul, I have verified that it works fine now:

netlabel_tools-0.20-1.el7

# netlabelctl map add domain:ping_t address:192.168.1.200/100 protocol:unlbl
netlabelctl: error, invalid argument or parameter
# netlabelctl map add domain:ping_t address:192.168.1.200/xyz protocol:unlbl
netlabelctl: error, invalid argument or parameter
# netlabelctl -p map list
Configured NetLabel domain mappings (1)
 domain: DEFAULT
   protocol: UNLABELED

I am setting netlabel_tools-0.20-1.el7 into "Fixed in Version" field.
Comment 10 Ludek Smid 2014-06-13 10:36:28 UTC 
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.
Note You need to log in before you can comment on or make changes to this bug.