[PATCH] conntrack: labels: Avoid crash when labels file is not installed

[PATCH] conntrack: labels: Avoid crash when labels file is not installed

[Marcos Paulo de Souza]

When CONNLABEL_CFG isn't available (/etc/xtables/connlabel.conf),
conntrack tool crashes:

[marcos@Icarus ~]$ conntrack -l something
nfct_labelmap_new: No such file or directory
Segmentation fault (core dumped)

I can see this problem in Fedora 26, because connlabel.conf does not
come along the conntrack/libnetfilter packages. This problem happens because
conntrack calls nfct_labelmap_new, which resides on
libnetfilter_conntrack. So this lib returns NULL because CONNLABEL_CFG
is not present, and then NULL is assigned to the global var called
labelmap on conntrack. Later, get_label is called, passing NULL to the
library, and __label_get_bit is called and deferences labelmap without
check, which leads to a crash.

With this patch on libnetlfilter_conntrack, the crash does not happen anymore,
and an error message is displayed:

[marcos@Icarus conntrack-tools]$
LD_LIBRARY_PATH=/mnt/data/gitroot/libnetfilter_conntrack/src/.libs/
conntrack -l something
nfct_labelmap_new: No such file or directory
conntrack v1.4.4 (conntrack-tools): unknown label 'something'
Try `conntrack -h' or 'conntrack --help' for more information.

Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>
---
This is my first patch to netfilter and conntrack-tools, so please let
me know if I sent to the right place, or if the patch needs more work.

That "No Such file..." comes from a perror on conntrack, when
labelmap_init returns NULL.

Thanks!

 src/conntrack/labels.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/conntrack/labels.c b/src/conntrack/labels.c
index 8048076..6d811ad 100644
--- a/src/conntrack/labels.c
+++ b/src/conntrack/labels.c
@@ -51,7 +51,11 @@ static unsigned int hash_name(const char *name)
 
 int __labelmap_get_bit(struct nfct_labelmap *m, const char *name)
 {
-	unsigned int i = hash_name(name);
+	unsigned int i;
+	if (!m)
+		return -1;
+
+	i = hash_name(name);
 	struct labelmap_bucket *list = m->map_name[i];
 
 	while (list) {
-- 
2.13.3

Re: [PATCH] conntrack: labels: Avoid crash when labels file is not installed

[Florian Westphal]

Marcos Paulo de Souza <marcos.souza.org@gmail.com> wrote:
> [marcos@Icarus ~]$ conntrack -l something
> nfct_labelmap_new: No such file or directory
> Segmentation fault (core dumped)

conntrack should not pass NULL in the first place.
However I agree that lnf-conntrack should be more robust
so I applied this patch, thanks.

> This is my first patch to netfilter and conntrack-tools, so please let
> me know if I sent to the right place, or if the patch needs more work.

I changed patch title to 'labels: don't crash on NULL labelmap'.

>  int __labelmap_get_bit(struct nfct_labelmap *m, const char *name)
>  {
> -	unsigned int i = hash_name(name);
> +	unsigned int i;
> +	if (!m)
> +		return -1;
> +
> +	i = hash_name(name);
>  	struct labelmap_bucket *list = m->map_name[i];

I moved this a bit to avoid mixing declaration and code, but otherwise
it should be the same change.