Hide Forgot
Description of problem: Netlabelctl does allow to add mapping with malformed address prefix. It should check that prefix is correct and not out of range. It is also possible to use non-numeric values as prefix. Version-Release number of selected component (if applicable): netlabel_tools-0.20-0.el7 How reproducible: 100% Steps to Reproduce: 1. netlabelctl map add domain:ping_t address:192.168.1.200/100 protocol:unlbl 2. netlabelctl map add domain:ping_t address:192.168.1.200/xyz protocol:unlbl Actual results: 1. domain:"ping_t",address:192.168.1.200/32,protocol:UNLABELED domain:DEFAULT,UNLABELED 2. domain:"ping_t",address:0.0.0.0/0,protocol:UNLABELED domain:DEFAULT,UNLABELED Expected results: netlabelctl: error, invalid argument or parameter Additional info: N/A
The issue appears to be in netlabelctl's nlctl_addr_parse() function where it relies on atoi() to convert the mask to an integer value (hence the '0' mask value in the example above). We should add some extra checking to verify that the mask is 1) a number and 2) between 0 and 32 inclusive. We also need to do something similar for IPv6 and the network addresses as well. I verified the kernel has the necessary input checking in place, the issue is solely in how netlabelctl converts the user input into a network mask.
Created attachment 816284 [details] Proposed patch which corrects the problem
Patch committed upstream: commit 2a084f9d79945b1d6d4b5abf7e4d19f1588daaaa Author: Paul Moore <pmoore> Date: Fri Oct 25 16:46:15 2013 -0400 netlabelctl: add additional validation code to the network address parser It is possible to use network masks with non-integer values or integer values greater than the size of the network address, this patch fixes this. Signed-off-by: Paul Moore <pmoore>
Using the patch provided above the problem appears to be fixed for me: # netlabelctl -p map list Configured NetLabel domain mappings (1) domain: DEFAULT protocol: UNLABELED # netlabelctl -p map add domain:ping_t address:192.168.1.200/100 protocol:unlbl netlabelctl: error, invalid argument or parameter # netlabelctl -p map add domain:ping_t address:192.168.1.200/xyz protocol:unlbl netlabelctl: error, invalid argument or parameter # netlabelctl -p map list Configured NetLabel domain mappings (1) domain: DEFAULT protocol: UNLABELED # netlabelctl -p map add domain:ping_t address:192.168.1.200/24 protocol:unlbl # netlabelctl -p map add domain:ping_t address:192.168.1.201/32 protocol:unlbl # netlabelctl -p map add domain:ping_t address:192.168.1.202 protocol:unlbl # netlabelctl -p map list Configured NetLabel domain mappings (2) domain: "ping_t" address: 192.168.1.201/32 protocol: UNLABELED address: 192.168.1.202/32 protocol: UNLABELED address: 192.168.1.0/24 protocol: UNLABELED domain: DEFAULT protocol: UNLABELED
Great, thanks Paul, I have verified that it works fine now: netlabel_tools-0.20-1.el7 # netlabelctl map add domain:ping_t address:192.168.1.200/100 protocol:unlbl netlabelctl: error, invalid argument or parameter # netlabelctl map add domain:ping_t address:192.168.1.200/xyz protocol:unlbl netlabelctl: error, invalid argument or parameter # netlabelctl -p map list Configured NetLabel domain mappings (1) domain: DEFAULT protocol: UNLABELED I am setting netlabel_tools-0.20-1.el7 into "Fixed in Version" field.
This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request.