conntrack: fix nfct_clone with certain attribute data types

some attributes are pointers to malloc'd objects.  Simply copying the
pointer results in use-after free when the original or the clone is
destroyed.

Fix it by using nfct_copy instead of memcpy and add proper test case
for cloned objects:
- nfct_cmp of orig and clone should return 1 (equal)
- freeing both the original and the clone should
  neither leak memory nor result in double-frees.

the testsuite changes revealed a few more problems:
 - ct1->timeout == ct2->timeout returned 0, ie. same timeout
   was considered "not equal" by nfct_cmp
 - secctx comparision causes "Invalid address" valgrind warnings
   when pointer is NULL
 - NFCT_CP_OVERRIDE did not handle helper attribute and
   erronously freed ct1 secctx memory.

While at it, bump qa_test data dummy to 256 (else, valgrind
complains about move-depends-on-uninitialized-memory).

Lastly, fix compilation of test_api by killing bogus ATTR_CONNLABEL.

Signed-off-by: Florian Westphal <fw@strlen.de>

1 files changed, 3 insertions, 0 deletions

diff --git a/src/conntrack/copy.c b/src/conntrack/copy.c
index a6aa9f7..e66c952 100644
--- a/src/conntrack/copy.c
+++ b/src/conntrack/copy.c
@@ -524,5 +524,8 @@ void __copy_fast(struct nf_conntrack *ct1, const struct nf_conntrack *ct2)
 {
 	memcpy(ct1, ct2, sizeof(*ct1));
 	/* special case: secctx attribute is allocated dinamically. */
+	ct1->secctx = NULL;	/* don't free: ct2 uses it */
+	ct1->helper_info = NULL;
 	copy_attr_secctx(ct1, ct2);
+	copy_attr_help_info(ct1, ct2);
 }