4e9e3da
From d69b7cb2724f041f257b90184a64e28a667ee7e9 Mon Sep 17 00:00:00 2001
4e9e3da
From: Thomas Woerner <twoerner@redhat.com>
4e9e3da
Date: Thu, 8 Jun 2017 15:31:11 +0200
4e9e3da
Subject: [PATCH] firewall.core.rich: Add checks for Rich_Source validation
4e9e3da
4e9e3da
A rich-rule source needs to either contain a IP address, a MAC address or an
4e9e3da
ipset.
4e9e3da
---
4e9e3da
 src/firewall/core/rich.py | 24 +++++++++++++++++-------
4e9e3da
 1 file changed, 17 insertions(+), 7 deletions(-)
4e9e3da
4e9e3da
diff --git a/src/firewall/core/rich.py b/src/firewall/core/rich.py
4e9e3da
index 3adcb4d9..04791da6 100644
4e9e3da
--- a/src/firewall/core/rich.py
4e9e3da
+++ b/src/firewall/core/rich.py
4e9e3da
@@ -46,15 +46,21 @@ def __init__(self, addr, mac, ipset, invert=False):
4e9e3da
         if self.ipset == "":
4e9e3da
             self.ipset = None
4e9e3da
         self.invert = invert
4e9e3da
+        if self.addr is None and self.mac is None and self.ipset is None:
4e9e3da
+            raise FirewallError(errors.INVALID_RULE,
4e9e3da
+                                "no address, mac and ipset")
4e9e3da
 
4e9e3da
     def __str__(self):
4e9e3da
-        if self.addr:
4e9e3da
-            x = ' address="%s"' % self.addr
4e9e3da
-        elif self.mac:
4e9e3da
-            x = ' mac="%s"' % self.mac
4e9e3da
-        elif self.ipset:
4e9e3da
-            x = ' ipset="%s"' % self.ipset
4e9e3da
-        return 'source%s%s' % (" NOT" if self.invert else "", x)
4e9e3da
+        ret = 'source%s ' % (" NOT" if self.invert else "")
4e9e3da
+        if self.addr is not None:
4e9e3da
+            return ret + 'address="%s"' % self.addr
4e9e3da
+        elif self.mac is not None:
4e9e3da
+            return ret + 'mac="%s"' % self.mac
4e9e3da
+        elif self.ipset is not None:
4e9e3da
+            return ret + 'ipset="%s"' % self.ipset
4e9e3da
+        else:
4e9e3da
+            raise FirewallError(errors.INVALID_RULE,
4e9e3da
+                                "no address, mac and ipset")
4e9e3da
 
4e9e3da
 class Rich_Destination(object):
4e9e3da
     def __init__(self, addr, invert=False):
4e9e3da
@@ -542,10 +548,14 @@ def check(self):
4e9e3da
                     raise FirewallError(errors.INVALID_FAMILY)
4e9e3da
                 if self.source.mac is not None:
4e9e3da
                     raise FirewallError(errors.INVALID_RULE, "address and mac")
4e9e3da
+                if self.source.ipset is not None:
4e9e3da
+                    raise FirewallError(errors.INVALID_RULE, "address and ipset")
4e9e3da
                 if not functions.check_address(self.family, self.source.addr):
4e9e3da
                     raise FirewallError(errors.INVALID_ADDR, str(self.source.addr))
4e9e3da
 
4e9e3da
             elif self.source.mac is not None:
4e9e3da
+                if self.source.ipset is not None:
4e9e3da
+                    raise FirewallError(errors.INVALID_RULE, "mac and ipset")
4e9e3da
                 if not functions.check_mac(self.source.mac):
4e9e3da
                     raise FirewallError(errors.INVALID_MAC, str(self.source.mac))
4e9e3da