[pve-devel] [PATCH proxmox-firewall] config: nftables: add support for icmp-type any

[Stefan Hanreich]

We support any as wildcard for matching all icmp types. Implement
parsing logic for parsing the any value and support converting the any
value into an nftables expression.

Signed-off-by: Stefan Hanreich <s.hanreich at proxmox.com>
---
 proxmox-nftables/src/expression.rs                 |  2 ++
 proxmox-ve-config/src/firewall/types/rule_match.rs | 12 ++++++++++++
 2 files changed, 14 insertions(+)

diff --git a/proxmox-nftables/src/expression.rs b/proxmox-nftables/src/expression.rs
index 20559e8..18b92d4 100644
--- a/proxmox-nftables/src/expression.rs
+++ b/proxmox-nftables/src/expression.rs
@@ -185,6 +185,7 @@ impl From<&IcmpType> for Expression {
         match value {
             IcmpType::Numeric(id) => Expression::from(*id),
             IcmpType::Named(name) => Expression::from(*name),
+            IcmpType::Any => Expression::Range(Box::new((u8::MIN.into(), u8::MAX.into()))),
         }
     }
 }
@@ -205,6 +206,7 @@ impl From<&Icmpv6Type> for Expression {
         match value {
             Icmpv6Type::Numeric(id) => Expression::from(*id),
             Icmpv6Type::Named(name) => Expression::from(*name),
+            Icmpv6Type::Any => Expression::Range(Box::new((u8::MIN.into(), u8::MAX.into()))),
         }
     }
 }
diff --git a/proxmox-ve-config/src/firewall/types/rule_match.rs b/proxmox-ve-config/src/firewall/types/rule_match.rs
index 948b426..94d8624 100644
--- a/proxmox-ve-config/src/firewall/types/rule_match.rs
+++ b/proxmox-ve-config/src/firewall/types/rule_match.rs
@@ -511,6 +511,7 @@ impl FromStr for Icmp {
 pub enum IcmpType {
     Numeric(u8),
     Named(&'static str),
+    Any,
 }
 
 #[sortable]
@@ -536,6 +537,10 @@ impl std::str::FromStr for IcmpType {
     type Err = Error;
 
     fn from_str(s: &str) -> Result<Self, Error> {
+        if s.eq_ignore_ascii_case("any") {
+            return Ok(Self::Any);
+        }
+
         if let Ok(ty) = s.trim().parse::<u8>() {
             return Ok(Self::Numeric(ty));
         }
@@ -553,6 +558,7 @@ impl fmt::Display for IcmpType {
         match self {
             IcmpType::Numeric(ty) => write!(f, "{ty}"),
             IcmpType::Named(ty) => write!(f, "{ty}"),
+            IcmpType::Any => write!(f, "any"),
         }
     }
 }
@@ -664,6 +670,7 @@ impl FromStr for Icmpv6 {
 pub enum Icmpv6Type {
     Numeric(u8),
     Named(&'static str),
+    Any,
 }
 
 #[sortable]
@@ -693,6 +700,10 @@ impl std::str::FromStr for Icmpv6Type {
     type Err = Error;
 
     fn from_str(s: &str) -> Result<Self, Error> {
+        if s.eq_ignore_ascii_case("any") {
+            return Ok(Self::Any);
+        }
+
         if let Ok(ty) = s.trim().parse::<u8>() {
             return Ok(Self::Numeric(ty));
         }
@@ -710,6 +721,7 @@ impl fmt::Display for Icmpv6Type {
         match self {
             Icmpv6Type::Numeric(ty) => write!(f, "{ty}"),
             Icmpv6Type::Named(ty) => write!(f, "{ty}"),
+            Icmpv6Type::Any => write!(f, "any"),
         }
     }
 }
-- 
2.39.2