Bug 1003909 - netlabelctl does not check correct address format
netlabelctl does not check correct address format
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: netlabel_tools (Show other bugs)
7.0
All Linux
low Severity low
: beta
: 7.0
Assigned To: Paul Moore
Ondrej Moriš
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-09-03 09:40 EDT by Ondrej Moriš
Modified: 2014-06-18 01:27 EDT (History)
0 users

See Also:
Fixed In Version: netlabel_tools-0.20-1.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-06-13 06:36:28 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Proposed patch which corrects the problem (2.28 KB, patch)
2013-10-25 17:52 EDT, Paul Moore
no flags Details | Diff

  None (edit)
Description Ondrej Moriš 2013-09-03 09:40:14 EDT
Description of problem:

Netlabelctl does allow to add mapping with malformed address prefix. It should check that prefix is correct and not out of range. It is also possible to use non-numeric values as prefix.

Version-Release number of selected component (if applicable):

netlabel_tools-0.20-0.el7

How reproducible:

100%

Steps to Reproduce:

1. netlabelctl map add domain:ping_t address:192.168.1.200/100 protocol:unlbl
2. netlabelctl map add domain:ping_t address:192.168.1.200/xyz protocol:unlbl

Actual results:

1. domain:"ping_t",address:192.168.1.200/32,protocol:UNLABELED     
   domain:DEFAULT,UNLABELED
2. domain:"ping_t",address:0.0.0.0/0,protocol:UNLABELED 
   domain:DEFAULT,UNLABELED

Expected results:

netlabelctl: error, invalid argument or parameter

Additional info:

N/A
Comment 1 Paul Moore 2013-10-25 11:29:34 EDT
The issue appears to be in netlabelctl's nlctl_addr_parse() function where it relies on atoi() to convert the mask to an integer value (hence the '0' mask value in the example above).  We should add some extra checking to verify that the mask is 1) a number and 2) between 0 and 32 inclusive.  We also need to do something similar for IPv6 and the network addresses as well.

I verified the kernel has the necessary input checking in place, the issue is solely in how netlabelctl converts the user input into a network mask.
Comment 2 Paul Moore 2013-10-25 17:52:54 EDT
Created attachment 816284 [details]
Proposed patch which corrects the problem
Comment 4 Paul Moore 2013-10-25 17:56:54 EDT
Patch committed upstream:

commit 2a084f9d79945b1d6d4b5abf7e4d19f1588daaaa
Author: Paul Moore <pmoore@redhat.com>
Date:   Fri Oct 25 16:46:15 2013 -0400

    netlabelctl: add additional validation code to the network address parser
    
    It is possible to use network masks with non-integer values or integer
    values greater than the size of the network address, this patch fixes
    this.
    
    Signed-off-by: Paul Moore <pmoore@redhat.com>
Comment 5 Paul Moore 2013-10-25 17:58:42 EDT
Using the patch provided above the problem appears to be fixed for me:

# netlabelctl -p map list
Configured NetLabel domain mappings (1)
 domain: DEFAULT
   protocol: UNLABELED
# netlabelctl -p map add domain:ping_t address:192.168.1.200/100 protocol:unlbl
netlabelctl: error, invalid argument or parameter
# netlabelctl -p map add domain:ping_t address:192.168.1.200/xyz protocol:unlbl
netlabelctl: error, invalid argument or parameter
# netlabelctl -p map list
Configured NetLabel domain mappings (1)
 domain: DEFAULT
   protocol: UNLABELED
# netlabelctl -p map add domain:ping_t address:192.168.1.200/24 protocol:unlbl
# netlabelctl -p map add domain:ping_t address:192.168.1.201/32 protocol:unlbl
# netlabelctl -p map add domain:ping_t address:192.168.1.202 protocol:unlbl
# netlabelctl -p map list
Configured NetLabel domain mappings (2)
 domain: "ping_t"
   address: 192.168.1.201/32
    protocol: UNLABELED
   address: 192.168.1.202/32
    protocol: UNLABELED
   address: 192.168.1.0/24
    protocol: UNLABELED
 domain: DEFAULT
   protocol: UNLABELED
Comment 9 Ondrej Moriš 2013-12-09 07:19:48 EST
Great, thanks Paul, I have verified that it works fine now:

netlabel_tools-0.20-1.el7

# netlabelctl map add domain:ping_t address:192.168.1.200/100 protocol:unlbl
netlabelctl: error, invalid argument or parameter
# netlabelctl map add domain:ping_t address:192.168.1.200/xyz protocol:unlbl
netlabelctl: error, invalid argument or parameter
# netlabelctl -p map list
Configured NetLabel domain mappings (1)
 domain: DEFAULT
   protocol: UNLABELED

I am setting netlabel_tools-0.20-1.el7 into "Fixed in Version" field.
Comment 10 Ludek Smid 2014-06-13 06:36:28 EDT
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.

Note You need to log in before you can comment on or make changes to this bug.