[PATCH] build: add and use a symbol version map

[PATCH] build: add and use a symbol version map

[Jan Engelhardt]

It was possible to combine e.g. conntrackd-1.2.1 with
libnetfilter_conntrack-0.0.101, causing libc to issue an exit from
within conntrackd iff such a conntrackd was promoted to a master and
tried to call nfexp_send, due to lazy symbol resolution in libc.

Symbol versions enforce the checks at program startup, so add one.

$ ldd -r /usr/sbin/conntrackd
undefined symbol: nfexp_cmp     (/usr/sbin/conntrackd)
undefined symbol: nfexp_send    (/usr/sbin/conntrackd)
        libnetfilter_conntrack.so.3 => /usr/lib/libnetfilter_conntrack.so.3 (0x77fe7000)
        libnfnetlink.so.0 => /usr/lib/libnfnetlink.so.0 (0x77fdf000)
        libc.so.6 => /lib/libc.so.6 (0x77e7b000)
        libdl.so.2 => /lib/libdl.so.2 (0x77e76000)
        /lib/ld.so.1 (0x55555000)
$ dpkg-query -W conntrackd libnetfilter-conntrack3
conntrackd      1:1.2.1-1
libnetfilter-conntrack3 0.0.101-1

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
---
 src/Makefile.am                |   4 +-
 src/libnetfilter_conntrack.map | 109 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 112 insertions(+), 1 deletion(-)
 create mode 100644 src/libnetfilter_conntrack.map

diff --git a/src/Makefile.am b/src/Makefile.am
index 7d6c905..918c2ba 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -12,5 +12,7 @@ libnetfilter_conntrack_la_LIBADD = conntrack/libnfconntrack.la \
 				   expect/libnfexpect.la \
 				   ${LIBNFNETLINK_LIBS} ${LIBMNL_LIBS}
 libnetfilter_conntrack_la_LDFLAGS = -Wc,-nostartfiles -lnfnetlink -ldl 	\
-				    -version-info $(LIBVERSION)
+				    -version-info $(LIBVERSION) \
+				    -Wl,--version-script=$(srcdir)/libnetfilter_conntrack.map
 libnetfilter_conntrack_la_SOURCES = main.c callback.c
+libnetfilter_conntrack_la_DEPENDENCIES = libnetfilter_conntrack.map
diff --git a/src/libnetfilter_conntrack.map b/src/libnetfilter_conntrack.map
new file mode 100644
index 0000000..c6404d5
--- /dev/null
+++ b/src/libnetfilter_conntrack.map
@@ -0,0 +1,109 @@
+V_1.0.5 {
+global:
+	nfct_attr_grp_is_set;
+	nfct_attr_grp_unset;
+	nfct_attr_is_set;
+	nfct_attr_is_set_array;
+	nfct_attr_unset;
+	nfct_bitmask_clear;
+	nfct_bitmask_clone;
+	nfct_bitmask_destroy;
+	nfct_bitmask_equal;
+	nfct_bitmask_maxbit;
+	nfct_bitmask_new;
+	nfct_bitmask_set_bit;
+	nfct_bitmask_test_bit;
+	nfct_bitmask_unset_bit;
+	nfct_build_conntrack;
+	nfct_build_query;
+	nfct_build_tuple;
+	nfct_callback_register;
+	nfct_callback_register2;
+	nfct_callback_unregister;
+	nfct_callback_unregister2;
+	nfct_catch;
+	nfct_clone;
+	nfct_close;
+	nfct_cmp;
+	nfct_compare;
+	nfct_copy;
+	nfct_copy_attr;
+	nfct_destroy;
+	nfct_fd;
+	nfct_filter_add_attr;
+	nfct_filter_add_attr_u32;
+	nfct_filter_attach;
+	nfct_filter_create;
+	nfct_filter_destroy;
+	nfct_filter_detach;
+	nfct_filter_dump_create;
+	nfct_filter_dump_destroy;
+	nfct_filter_dump_set_attr;
+	nfct_filter_dump_set_attr_u8;
+	nfct_filter_set_logic;
+	nfct_get_attr;
+	nfct_get_attr_grp;
+	nfct_get_attr_u16;
+	nfct_get_attr_u32;
+	nfct_get_attr_u64;
+	nfct_get_attr_u8;
+	nfct_getobjopt;
+	nfct_labelmap_destroy;
+	nfct_labelmap_get_bit;
+	nfct_labelmap_get_name;
+	nfct_labelmap_new;
+	nfct_maxsize;
+	nfct_new;
+	nfct_nfnlh;
+	nfct_nlmsg_build;
+	nfct_nlmsg_parse;
+	nfct_open;
+	nfct_open_nfnl;
+	nfct_parse_conntrack;
+	nfct_parse_tuple;
+	nfct_payload_parse;
+	nfct_query;
+	nfct_send;
+	nfct_set_attr;
+	nfct_set_attr_grp;
+	nfct_set_attr_l;
+	nfct_set_attr_u16;
+	nfct_set_attr_u32;
+	nfct_set_attr_u64;
+	nfct_set_attr_u8;
+	nfct_setobjopt;
+	nfct_sizeof;
+	nfct_snprintf;
+	nfct_snprintf_labels;
+	nfexp_attr_is_set;
+	nfexp_attr_unset;
+	nfexp_build_expect;
+	nfexp_build_query;
+	nfexp_callback_register;
+	nfexp_callback_register2;
+	nfexp_callback_unregister;
+	nfexp_callback_unregister2;
+	nfexp_catch;
+	nfexp_clone;
+	nfexp_cmp;
+	nfexp_destroy;
+	nfexp_get_attr;
+	nfexp_get_attr_u16;
+	nfexp_get_attr_u32;
+	nfexp_get_attr_u8;
+	nfexp_maxsize;
+	nfexp_new;
+	nfexp_nlmsg_build;
+	nfexp_nlmsg_parse;
+	nfexp_parse_expect;
+	nfexp_query;
+	nfexp_send;
+	nfexp_set_attr;
+	nfexp_set_attr_u16;
+	nfexp_set_attr_u32;
+	nfexp_set_attr_u8;
+	nfexp_sizeof;
+	nfexp_snprintf;
+local:
+	*;
+};
-- 
2.1.2

Re: [PATCH] build: add and use a symbol version map

[Pablo Neira Ayuso]

On Wed, Nov 12, 2014 at 02:06:47PM +0100, Jan Engelhardt wrote:
> It was possible to combine e.g. conntrackd-1.2.1 with
> libnetfilter_conntrack-0.0.101, causing libc to issue an exit from
> within conntrackd iff such a conntrackd was promoted to a master and
> tried to call nfexp_send, due to lazy symbol resolution in libc.

I wonder how you have reached such a situation. I can only think of
very broken packaging.

> Symbol versions enforce the checks at program startup, so add one.
>
> $ ldd -r /usr/sbin/conntrackd
> undefined symbol: nfexp_cmp     (/usr/sbin/conntrackd)
> undefined symbol: nfexp_send    (/usr/sbin/conntrackd)
>         libnetfilter_conntrack.so.3 => /usr/lib/libnetfilter_conntrack.so.3 (0x77fe7000)
>         libnfnetlink.so.0 => /usr/lib/libnfnetlink.so.0 (0x77fdf000)
>         libc.so.6 => /lib/libc.so.6 (0x77e7b000)
>         libdl.so.2 => /lib/libdl.so.2 (0x77e76000)
>         /lib/ld.so.1 (0x55555000)
> $ dpkg-query -W conntrackd libnetfilter-conntrack3
> conntrackd      1:1.2.1-1
> libnetfilter-conntrack3 0.0.101-1

Would you also convert libnetfilter_conntrack to use the same
EXPORT_SYMBOL() macro that we use in more recent libnetfilter_*
libraries for consistency?

Re: [PATCH] build: add and use a symbol version map

[Jan Engelhardt]

On Wednesday 2014-11-19 14:42, Pablo Neira Ayuso wrote:
>On Wed, Nov 12, 2014 at 02:06:47PM +0100, Jan Engelhardt wrote:
>> It was possible to combine e.g. conntrackd-1.2.1 with
>> libnetfilter_conntrack-0.0.101, causing libc to issue an exit from
>> within conntrackd iff such a conntrackd was promoted to a master and
>> tried to call nfexp_send, due to lazy symbol resolution in libc.
>
>I wonder how you have reached such a situation. I can only think of
>very broken packaging.

To reach such a situation, the shortest way to get there is:

1. On Debian squeeze, `apt-get install conntrack`.
This would install conntrack-tools-0.9.14.

2. Install a newer version at some point,
`perl -i -pe s/squeeze/wheezy/g /etc/apt/sources.list &&
 apt-get update && apt-get install conntrack`.



The long description:

The conntrack-tools source code only checks the
libnetfilter_conntrack version only once, at build time.

The files in the top-level source directory of conntrack-tools do not
indicate any particular runtime requirement on libnetfilter_conntrack
version besides the implicit requirement of the built conntrackd on a
particular library by SONAME, in other words, the runtime
requirements are weaker than the build-time requirements.

Such a case is pretty normal, too. Build-time requirements are
generally seen as independent from runtime requirements by distros
and packagers. Some perl module may want Test::Simple at build time,
and not use it at runtime.
I cannot find that the Debian packager for conntrack-tools has
done something inappropriate.


>Would you also convert libnetfilter_conntrack to use the same
>EXPORT_SYMBOL() macro that we use in more recent libnetfilter_*
>libraries for consistency?

I can; question is, do we need it? It turns out that using
just a .map file (with implicit -fvisibility=default) gives
the same result, but requiring less steps. The map file
can also turn symbols from visible to hidden, without requiring
-fvisibility+EXPORT_SYMBOLs.