conntrack: fix nfct_clone with certain attribute data types

some attributes are pointers to malloc'd objects.  Simply copying the
pointer results in use-after free when the original or the clone is
destroyed.

Fix it by using nfct_copy instead of memcpy and add proper test case
for cloned objects:
- nfct_cmp of orig and clone should return 1 (equal)
- freeing both the original and the clone should
  neither leak memory nor result in double-frees.

the testsuite changes revealed a few more problems:
 - ct1->timeout == ct2->timeout returned 0, ie. same timeout
   was considered "not equal" by nfct_cmp
 - secctx comparision causes "Invalid address" valgrind warnings
   when pointer is NULL
 - NFCT_CP_OVERRIDE did not handle helper attribute and
   erronously freed ct1 secctx memory.

While at it, bump qa_test data dummy to 256 (else, valgrind
complains about move-depends-on-uninitialized-memory).

Lastly, fix compilation of test_api by killing bogus ATTR_CONNLABEL.

Signed-off-by: Florian Westphal <fw@strlen.de>

1 files changed, 8 insertions, 2 deletions

diff --git a/qa/test_api.c b/qa/test_api.c
index e44c228..cdd128a 100644
--- a/qa/test_api.c
+++ b/qa/test_api.c
@@ -2,6 +2,7 @@
  * Run this after adding a new attribute to the nf_conntrack object
  */
 
+#include <assert.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
@@ -35,7 +36,7 @@ int main(void)
 	int ret, i;
 	struct nf_conntrack *ct, *ct2, *tmp;
 	struct nf_expect *exp, *tmp_exp;
-	char data[32];
+	char data[256];
 	const char *val;
 	int status;
 
@@ -93,7 +94,6 @@ int main(void)
 			case ATTR_SECCTX:
 			case ATTR_TIMESTAMP_START:
 			case ATTR_TIMESTAMP_STOP:
-			case ATTR_CONNLABELS:
 				continue;
 			/* These attributes require special handling */
 			case ATTR_HELPER_INFO:
@@ -206,6 +206,11 @@ int main(void)
 		eval_sigterm(status);
 	}
 
+	ct2 = nfct_clone(ct);
+	assert(ct2);
+	assert(nfct_cmp(ct, ct2, NFCT_CMP_ALL) == 1);
+	nfct_destroy(ct2);
+
 	ct2 = nfct_new();
 	if (!ct2) {
 		perror("nfct_new");
@@ -271,6 +276,7 @@ int main(void)
 	}
 
 	nfct_destroy(ct2);
+	printf("== destroy cloned ct entry ==\n");
 	nfct_destroy(ct);
 	nfct_destroy(tmp);
 	nfexp_destroy(exp);