Merge remote-tracking branch 'origin/pr/151'

* origin/pr/151: Fixed inconsistent firewall address checking
QubesOS · Jul 15, 2020 · 2bdeb76 · 2bdeb76
2 parents f9c5b61 + 9377add
commit 2bdeb76
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/qubesadmin/firewall.py b/qubesadmin/firewall.py
@@ -23,6 +23,8 @@
 
 import datetime
 import socket
+import string
+
 
 class RuleOption(object):
     '''Base class for a single rule element'''
@@ -120,6 +122,9 @@ def __init__(self, value, prefixlen=None):
                 except socket.error:
                     self.type = 'dsthost'
                     self.prefixlen = 0
+                    safe_set = string.ascii_lowercase + string.digits + '-._'
+                    if not all(c in safe_set for c in value):
+                        raise ValueError('Invalid hostname')
         else:
             host, prefixlen = value.split('/', 1)
             prefixlen = int(prefixlen)

diff --git a/qubesadmin/tests/firewall.py b/qubesadmin/tests/firewall.py
@@ -176,7 +176,6 @@ def test_015_ipv6_invalid_network(self):
         with self.assertRaises(ValueError):
             qubesadmin.firewall.DstHost('2001:abcd:efab::3/64')
 
-    @unittest.expectedFailure
     def test_020_invalid_hostname(self):
         with self.assertRaises(ValueError):
             qubesadmin.firewall.DstHost('www  qubes-os.org')