[pve-devel] [PATCH v2 firewall 6/6] simulator: use new bridge naming scheme

[DERUMIER, Alexandre]

hi,I think you should limit to 8 characters like for sdn vnet, 

as we need to space to  vlan tag for example (vmbrY.XXXX), or other sdn
construct.


-------- Message initial --------
De: Stefan Hanreich <s.hanreich at proxmox.com>
Répondre à: Proxmox VE development discussion <pve-
devel at lists.proxmox.com>
À: pve-devel at lists.proxmox.com
Objet: [pve-devel] [PATCH v2 firewall 6/6] simulator: use new bridge
naming scheme
Date: 23/02/2024 15:36:51

We now allow bridges without the vmbr prefix, so we need to allow them
here in the simulator as well.

Signed-off-by: Stefan Hanreich <s.hanreich at proxmox.com>
---
 src/PVE/FirewallSimulator.pm    | 20 ++++++++++----------
 src/PVE/Service/pve_firewall.pm |  4 ++--
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/src/PVE/FirewallSimulator.pm
b/src/PVE/FirewallSimulator.pm
index 140c46e..bd297d5 100644
--- a/src/PVE/FirewallSimulator.pm
+++ b/src/PVE/FirewallSimulator.pm
@@ -397,7 +397,7 @@ sub route_packet {
 	    $pkg->{physdev_in} = $target->{fwln} || die 'internal
error';
 	    $pkg->{physdev_out} = $target->{tapdev} || die 'internal
error';
 
-	} elsif ($route_state =~ m/^vmbr\d+$/) {
+	} elsif ($route_state =~ m/^[a-zA-Z][a-zA-Z0-9]{0,14}$/) {
 
 	    die "missing physdev_in - internal error?" if
!$physdev_in;
 	    $pkg->{physdev_in} = $physdev_in;
@@ -531,11 +531,6 @@ sub simulate_firewall {
 	$from_info->{type} = 'host';
 	$start_state = 'host';
 	$pkg->{source} = $host_ip if !defined($pkg->{source});
-    } elsif ($from =~ m|^(vmbr\d+)/(\S+)$|) {
-	$from_info->{type} = 'bport';
-	$from_info->{bridge} = $1;
-	$from_info->{iface} = $2;
-	$start_state = 'from-bport';
     } elsif ($from eq 'outside') {
 	$from_info->{type} = 'bport';
 	$from_info->{bridge} = 'vmbr0';
@@ -559,6 +554,11 @@ sub simulate_firewall {
 	$from_info = extract_vm_info($vmdata, $vmid, $netnum);
 	$start_state = 'fwbr-out';
 	$pkg->{mac_source} = $from_info->{macaddr};
+    } elsif ($from =~ m|^([a-zA-Z][a-zA-Z0-9]{0,14})/(\S+)$|) {
+	$from_info->{type} = 'bport';
+	$from_info->{bridge} = $1;
+	$from_info->{iface} = $2;
+	$start_state = 'from-bport';
     } else {
 	die "unable to parse \"from => '$from'\"\n";
     }
@@ -569,10 +569,6 @@ sub simulate_firewall {
 	$target->{type} = 'host';
 	$target->{iface} = 'host';
 	$pkg->{dest} = $host_ip if !defined($pkg->{dest});
-    } elsif ($to =~ m|^(vmbr\d+)/(\S+)$|) {
-	$target->{type} = 'bport';
-	$target->{bridge} = $1;
-	$target->{iface} = $2;
     } elsif ($to eq 'outside') {
 	$target->{type} = 'bport';
 	$target->{bridge} = 'vmbr0';
@@ -591,6 +587,10 @@ sub simulate_firewall {
 	my $vmid = $1;
 	$target = extract_vm_info($vmdata, $vmid, 0);
 	$target->{iface} = $target->{tapdev};
+    } elsif ($to =~ m|^([a-zA-Z][a-zA-Z0-9]{0,14})/(\S+)$|) {
+	$target->{type} = 'bport';
+	$target->{bridge} = $1;
+	$target->{iface} = $2;
     } else {
 	die "unable to parse \"to => '$to'\"\n";
     }
diff --git a/src/PVE/Service/pve_firewall.pm
b/src/PVE/Service/pve_firewall.pm
index 30d14d9..20fbc31 100755
--- a/src/PVE/Service/pve_firewall.pm
+++ b/src/PVE/Service/pve_firewall.pm
@@ -312,14 +312,14 @@ __PACKAGE__->register_method ({
 	    from => {
 		description => "Source zone.",
 		type => 'string',
-		pattern => '(host|outside|vm\d+|ct\d+|vmbr\d+/\S+)',
+		pattern => '(host|outside|vm\d+|ct\d+|([a-zA-Z][a-zA-
Z0-9]{0,14})/(\S+))',
 		optional => 1,
 		default => 'outside',
 	    },
 	    to => {
 		description => "Destination zone.",
 		type => 'string',
-		pattern => '(host|outside|vm\d+|ct\d+|vmbr\d+/\S+)',
+		pattern => '(host|outside|vm\d+|ct\d+|([a-zA-Z][a-zA-
Z0-9]{0,14})/(\S+))',
 		optional => 1,
 		default => 'host',
 	    },