From 4b2fecb2288fdd345f98890f9c801b1e4e2a5474 Mon Sep 17 00:00:00 2001
From: Phil Sutter <psutter@redhat.com>
Date: Thu, 25 Jun 2020 16:42:36 +0200
Subject: [PATCH 34/45] fix: core: rich: Catch ValueError on non-numeric
 priority values

Be a bit more user-friendly by printing:

| Error: INVALID_RULE: invalid 'priority' attribute value 'ab'.

instead of Python's default, which is:

| Error: invalid literal for int() with base 10: 'ab'

Fixes: rhbz 1689429
(cherry picked from commit 3a0e79b1cfe4344d21d30eb47c038252d728cc44)
(cherry picked from commit fa21382cc513cc0dba56ba085782a3e23c863afc)
---
 src/firewall/core/rich.py           |  5 ++++-
 src/tests/regression/regression.at  |  1 +
 src/tests/regression/rhbz1689429.at | 12 ++++++++++++
 3 files changed, 17 insertions(+), 1 deletion(-)
 create mode 100644 src/tests/regression/rhbz1689429.at

diff --git a/src/firewall/core/rich.py b/src/firewall/core/rich.py
index dacaeb9c0b70..eb4a2d2d9669 100644
--- a/src/firewall/core/rich.py
+++ b/src/firewall/core/rich.py
@@ -379,7 +379,10 @@ class Rich_Rule(object):
                         raise FirewallError(errors.INVALID_RULE, "'family' attribute cannot have '%s' value. Use 'ipv4' or 'ipv6' instead." % attr_value)
                     self.family = attr_value
                 elif attr_name == 'priority':
-                    self.priority = int(attr_value)
+                    try:
+                        self.priority = int(attr_value)
+                    except ValueError:
+                        raise FirewallError(errors.INVALID_RULE, "invalid 'priority' attribute value '%s'." % attr_value)
                 elif attr_name:
                     if attr_name == 'protocol':
                         err_msg = "wrong 'protocol' usage. Use either 'rule protocol value=...' or  'rule [forward-]port protocol=...'."
diff --git a/src/tests/regression/regression.at b/src/tests/regression/regression.at
index 984d299bfd4e..1c8f76afa87a 100644
--- a/src/tests/regression/regression.at
+++ b/src/tests/regression/regression.at
@@ -30,3 +30,4 @@ m4_include([regression/gh330.at])
 m4_include([regression/gh599.at])
 m4_include([regression/rhbz1829104.at])
 m4_include([regression/rhbz1843398.at])
+m4_include([regression/rhbz1689429.at])
diff --git a/src/tests/regression/rhbz1689429.at b/src/tests/regression/rhbz1689429.at
new file mode 100644
index 000000000000..5701607d660f
--- /dev/null
+++ b/src/tests/regression/rhbz1689429.at
@@ -0,0 +1,12 @@
+FWD_START_TEST([rich rule invalid priority])
+AT_KEYWORDS(rich rhbz1689429)
+
+FWD_CHECK([--add-rich-rule='rule priority=foo accept'], 122, [],
+	  [Error: INVALID_RULE: invalid 'priority' attribute value 'foo'.
+])
+FWD_CHECK([--permanent --add-rich-rule='rule priority=foo accept'], 122, [],
+	  [Error: INVALID_RULE: invalid 'priority' attribute value 'foo'.
+])
+FWD_RELOAD
+
+FWD_END_TEST([ignore])
-- 
2.27.0