Qubes/core-admin-client
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge remote-tracking branch 'origin/pr/139'

Browse Source 
* origin/pr/139:
  Added a safeguard for invalid firewall rules
This commit is contained in:
Marek Marczykowski-Górecki 2020-05-27 04:18:20 +02:00
commit b1453953f9
No known key found for this signature in database
GPG Key ID: 063938BA42CFA724
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
qubesadmin/tests/tools/qvm_firewall.py
View File

@ -96,6 +96,17 @@ class TC_00_RuleAction(qubesadmin.tests.QubesTestCase):
qubesadmin.firewall.Rule(
None, action='accept', dsthost='127.0.0.1/32'))
def test_007_none_errors(self):
ns = argparse.Namespace()
with self.assertRaises(argparse.ArgumentError):
self.action(None, ns, ['dsthost=', 'action=accept'])
with self.assertRaises(argparse.ArgumentError):
self.action(None, ns, ['dsthost=127.0.0.1', 'dstports=',
'action=accept'])
with self.assertRaises(argparse.ArgumentError):
self.action(None, ns, ['dsthost=127.0.0.1', 'icmptype=',
'action=accept'])
class TC_10_qvm_firewall(qubesadmin.tests.QubesTestCase):
def setUp(self):

3
qubesadmin/tools/qvm_firewall.py
View File

@ -48,6 +48,9 @@ class RuleAction(argparse.Action):
allowed_opts = assumed_order + ['specialtarget', 'comment', 'expire']
kwargs = {}
for opt in values:
if opt[-1] == '=':
raise argparse.ArgumentError(
None, 'invalid rule description: {}'.format(opt))
opt_elements = opt.split('=')
if len(opt_elements) == 2:
key, value = opt_elements