From dbce20e28a898c394274109904d471d84cfa7fea Mon Sep 17 00:00:00 2001
From: Vrinda Punj <vpunj@redhat.com>
Date: Fri, 13 Nov 2020 10:40:51 -0500
Subject: [PATCH 65/66] fix(rich): non-printable characters removed from rich
 rules

Fixes: rhbz 1596304
Fixes: #480

(cherry picked from commit ac5960856991a00ddf7a558e31fd3248c8279a1f)
(cherry picked from commit a55416ea5f79f1a7cb1a97b6ee39524a542a8663)
---
 src/firewall/core/rich.py           |  2 ++
 src/firewall/functions.py           |  9 ++++++++-
 src/tests/regression/regression.at  |  1 +
 src/tests/regression/rhbz1596304.at | 23 +++++++++++++++++++++++
 4 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 src/tests/regression/rhbz1596304.at

diff --git a/src/firewall/core/rich.py b/src/firewall/core/rich.py
index 86c0c998a478..03bc194c2b28 100644
--- a/src/firewall/core/rich.py
+++ b/src/firewall/core/rich.py
@@ -307,6 +307,8 @@ class Rich_Rule(object):
         if not rule_str:
             raise FirewallError(errors.INVALID_RULE, 'empty rule')
 
+        rule_str = functions.stripNonPrintableCharacters(rule_str)
+
         self.priority = 0
         self.family = None
         self.source = None
diff --git a/src/firewall/functions.py b/src/firewall/functions.py
index 6af220619f17..d20b702e047e 100644
--- a/src/firewall/functions.py
+++ b/src/firewall/functions.py
@@ -27,7 +27,7 @@ __all__ = [ "PY2", "getPortID", "getPortRange", "portStr", "getServiceName",
             "check_single_address", "check_mac", "uniqify", "ppid_of_pid",
             "max_zone_name_len", "checkUser", "checkUid", "checkCommand",
             "checkContext", "joinArgs", "splitArgs",
-            "b2u", "u2b", "u2b_if_py2" ]
+            "b2u", "u2b", "u2b_if_py2", "stripNonPrintableCharacters"]
 
 import socket
 import os
@@ -42,6 +42,10 @@ from firewall.config import FIREWALLD_TEMPDIR, FIREWALLD_PIDFILE
 
 PY2 = sys.version < '3'
 
+NOPRINT_TRANS_TABLE = {
+    i: None for i in range(0, sys.maxunicode + 1) if not chr(i).isprintable()
+}
+
 def getPortID(port):
     """ Check and Get port id from port string or port id using socket.getservbyname
 
@@ -226,6 +230,9 @@ def checkIPnMask(ip):
                 return False
     return True
 
+def stripNonPrintableCharacters(rule_str):
+    return rule_str.translate(NOPRINT_TRANS_TABLE)
+
 def checkIP6nMask(ip):
     if "/" in ip:
         addr = ip[:ip.index("/")]
diff --git a/src/tests/regression/regression.at b/src/tests/regression/regression.at
index 65540840f50e..c1e8620ee700 100644
--- a/src/tests/regression/regression.at
+++ b/src/tests/regression/regression.at
@@ -35,3 +35,4 @@ m4_include([regression/rhbz1483921.at])
 m4_include([regression/rhbz1541077.at])
 m4_include([regression/rhbz1855140.at])
 m4_include([regression/rhbz1871298.at])
+m4_include([regression/rhbz1596304.at])
diff --git a/src/tests/regression/rhbz1596304.at b/src/tests/regression/rhbz1596304.at
new file mode 100644
index 000000000000..98a33934e271
--- /dev/null
+++ b/src/tests/regression/rhbz1596304.at
@@ -0,0 +1,23 @@
+FWD_START_TEST([rich rules strip non-printable characters])
+AT_KEYWORDS(rich rhbz1596304)
+
+dnl source address contains a tab character
+FWD_CHECK([--permanent --zone=public --add-rich-rule 'rule family="ipv4" source address="104.243.250.0/22	" port port=80 protocol=tcp accept'],0,ignore)
+FWD_RELOAD
+FWD_CHECK([--list-all | TRIM_WHITESPACE], 0, [m4_strip([dnl
+        public
+        target: default
+        icmp-block-inversion: no
+        interfaces:
+        sources:
+        services: cockpit dhcpv6-client ssh
+        ports:
+        protocols:
+        masquerade: no
+        forward-ports:
+        source-ports:
+        icmp-blocks:
+        rich rules:
+	rule family="ipv4" source address="104.243.250.0/22" port port="80" protocol="tcp" accept
+    ])])
+FWD_END_TEST
-- 
2.28.0