|
 |
efd99ad |
From d69b7cb2724f041f257b90184a64e28a667ee7e9 Mon Sep 17 00:00:00 2001
|
|
|
efd99ad |
From: Thomas Woerner <twoerner@redhat.com>
|
|
|
efd99ad |
Date: Thu, 8 Jun 2017 15:31:11 +0200
|
|
|
efd99ad |
Subject: [PATCH] firewall.core.rich: Add checks for Rich_Source validation
|
|
|
efd99ad |
|
|
|
efd99ad |
A rich-rule source needs to either contain a IP address, a MAC address or an
|
|
|
efd99ad |
ipset.
|
|
|
efd99ad |
---
|
|
|
efd99ad |
src/firewall/core/rich.py | 24 +++++++++++++++++-------
|
|
|
efd99ad |
1 file changed, 17 insertions(+), 7 deletions(-)
|
|
|
efd99ad |
|
|
|
efd99ad |
diff --git a/src/firewall/core/rich.py b/src/firewall/core/rich.py
|
|
|
efd99ad |
index 3adcb4d9..04791da6 100644
|
|
|
efd99ad |
--- a/src/firewall/core/rich.py
|
|
|
efd99ad |
+++ b/src/firewall/core/rich.py
|
|
|
efd99ad |
@@ -46,15 +46,21 @@ def __init__(self, addr, mac, ipset, invert=False):
|
|
|
efd99ad |
if self.ipset == "":
|
|
|
efd99ad |
self.ipset = None
|
|
|
efd99ad |
self.invert = invert
|
|
|
efd99ad |
+ if self.addr is None and self.mac is None and self.ipset is None:
|
|
|
efd99ad |
+ raise FirewallError(errors.INVALID_RULE,
|
|
|
efd99ad |
+ "no address, mac and ipset")
|
|
|
efd99ad |
|
|
|
efd99ad |
def __str__(self):
|
|
|
efd99ad |
- if self.addr:
|
|
|
efd99ad |
- x = ' address="%s"' % self.addr
|
|
|
efd99ad |
- elif self.mac:
|
|
|
efd99ad |
- x = ' mac="%s"' % self.mac
|
|
|
efd99ad |
- elif self.ipset:
|
|
|
efd99ad |
- x = ' ipset="%s"' % self.ipset
|
|
|
efd99ad |
- return 'source%s%s' % (" NOT" if self.invert else "", x)
|
|
|
efd99ad |
+ ret = 'source%s ' % (" NOT" if self.invert else "")
|
|
|
efd99ad |
+ if self.addr is not None:
|
|
|
efd99ad |
+ return ret + 'address="%s"' % self.addr
|
|
|
efd99ad |
+ elif self.mac is not None:
|
|
|
efd99ad |
+ return ret + 'mac="%s"' % self.mac
|
|
|
efd99ad |
+ elif self.ipset is not None:
|
|
|
efd99ad |
+ return ret + 'ipset="%s"' % self.ipset
|
|
|
efd99ad |
+ else:
|
|
|
efd99ad |
+ raise FirewallError(errors.INVALID_RULE,
|
|
|
efd99ad |
+ "no address, mac and ipset")
|
|
|
efd99ad |
|
|
|
efd99ad |
class Rich_Destination(object):
|
|
|
efd99ad |
def __init__(self, addr, invert=False):
|
|
|
efd99ad |
@@ -542,10 +548,14 @@ def check(self):
|
|
|
efd99ad |
raise FirewallError(errors.INVALID_FAMILY)
|
|
|
efd99ad |
if self.source.mac is not None:
|
|
|
efd99ad |
raise FirewallError(errors.INVALID_RULE, "address and mac")
|
|
|
efd99ad |
+ if self.source.ipset is not None:
|
|
|
efd99ad |
+ raise FirewallError(errors.INVALID_RULE, "address and ipset")
|
|
|
efd99ad |
if not functions.check_address(self.family, self.source.addr):
|
|
|
efd99ad |
raise FirewallError(errors.INVALID_ADDR, str(self.source.addr))
|
|
|
efd99ad |
|
|
|
efd99ad |
elif self.source.mac is not None:
|
|
|
efd99ad |
+ if self.source.ipset is not None:
|
|
|
efd99ad |
+ raise FirewallError(errors.INVALID_RULE, "mac and ipset")
|
|
|
efd99ad |
if not functions.check_mac(self.source.mac):
|
|
|
efd99ad |
raise FirewallError(errors.INVALID_MAC, str(self.source.mac))
|
|
|
efd99ad |
|