[pve-devel] [PATCH proxmox-firewall v4 1/1] firewall: nftables: migrate to proxmox-network-types

[Stefan Hanreich]

The fabrics patch series moved some generic network types into its own
crate, so they can be reused across crates. Migrate proxmox-firewall
to use the new proxmox-network-types crate instead of
proxmox_ve_config.

Signed-off-by: Stefan Hanreich <s.hanreich at proxmox.com>
---

Notes:
    This depends on the changes in the proxmox-ve-rs repository.

 Cargo.toml                         |  1 +
 proxmox-firewall/Cargo.toml        |  1 +
 proxmox-firewall/src/firewall.rs   | 13 +++++++------
 proxmox-firewall/src/object.rs     |  4 +++-
 proxmox-firewall/src/rule.rs       |  3 ++-
 proxmox-nftables/Cargo.toml        |  3 ++-
 proxmox-nftables/src/expression.rs |  5 ++---
 proxmox-nftables/src/types.rs      |  2 +-
 8 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 079fb79..7e1ebb6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -7,3 +7,4 @@ resolver = "2"
 
 [workspace.dependencies]
 proxmox-ve-config = { version = "0.2.2" }
+proxmox-network-types = { version = "0.1" }
diff --git a/proxmox-firewall/Cargo.toml b/proxmox-firewall/Cargo.toml
index 09ea3fe..67622d2 100644
--- a/proxmox-firewall/Cargo.toml
+++ b/proxmox-firewall/Cargo.toml
@@ -22,6 +22,7 @@ signal-hook = "0.3"
 
 proxmox-nftables = { path = "../proxmox-nftables", features = ["config-ext"] }
 proxmox-ve-config = { workspace = true }
+proxmox-network-types = { workspace = true }
 
 [dev-dependencies]
 insta = { version = "1.21", features = ["json"] }
diff --git a/proxmox-firewall/src/firewall.rs b/proxmox-firewall/src/firewall.rs
index 607fc75..950c401 100644
--- a/proxmox-firewall/src/firewall.rs
+++ b/proxmox-firewall/src/firewall.rs
@@ -1,5 +1,6 @@
 use std::collections::BTreeMap;
 use std::fs;
+use std::net::IpAddr;
 
 use anyhow::{bail, Error};
 
@@ -20,7 +21,7 @@ use proxmox_ve_config::firewall::ct_helper::get_cthelper;
 use proxmox_ve_config::firewall::guest::Config as GuestConfig;
 use proxmox_ve_config::firewall::host::Config as HostConfig;
 
-use proxmox_ve_config::firewall::types::address::Ipv6Cidr;
+use proxmox_network_types::ip_address::Cidr;
 use proxmox_ve_config::firewall::types::ipset::{
     Ipfilter, Ipset, IpsetEntry, IpsetName, IpsetScope,
 };
@@ -800,17 +801,17 @@ impl Firewall {
                     let ipset_name = IpsetName::new(IpsetScope::Guest, ipfilter_name);
                     let mut ipset = Ipset::new(ipset_name);
 
-                    let cidr =
-                        Ipv6Cidr::from(network_device.mac_address().eui64_link_local_address());
+                    let link_local_address = network_device.mac_address().eui64_link_local_address();
+                    let cidr = Cidr::from(IpAddr::from(link_local_address));
 
-                    ipset.push(cidr.into());
+                    ipset.push(IpsetEntry::from(cidr));
 
                     if let Some(ip_address) = network_device.ip() {
-                        ipset.push(IpsetEntry::from(*ip_address));
+                        ipset.push(IpsetEntry::from(Cidr::from(*ip_address)));
                     }
 
                     if let Some(ip6_address) = network_device.ip6() {
-                        ipset.push(IpsetEntry::from(*ip6_address));
+                        ipset.push(IpsetEntry::from(Cidr::from(*ip6_address)));
                     }
 
                     commands.append(&mut ipset.to_nft_objects(&env)?);
diff --git a/proxmox-firewall/src/object.rs b/proxmox-firewall/src/object.rs
index cf7e773..cbfadba 100644
--- a/proxmox-firewall/src/object.rs
+++ b/proxmox-firewall/src/object.rs
@@ -11,11 +11,13 @@ use proxmox_nftables::{
 use proxmox_ve_config::{
     firewall::{
         ct_helper::CtHelperMacro,
-        types::{address::Family, alias::AliasName, ipset::IpsetAddress, Alias, Ipset},
+        types::{alias::AliasName, ipset::IpsetAddress, Alias, Ipset},
     },
     guest::types::Vmid,
 };
 
+use proxmox_network_types::ip_address::Family;
+
 use crate::config::FirewallConfig;
 
 pub(crate) struct NftObjectEnv<'a, 'b> {
diff --git a/proxmox-firewall/src/rule.rs b/proxmox-firewall/src/rule.rs
index 14ee544..16a0b5a 100644
--- a/proxmox-firewall/src/rule.rs
+++ b/proxmox-firewall/src/rule.rs
@@ -12,7 +12,6 @@ use proxmox_ve_config::{
         ct_helper::CtHelperMacro,
         fw_macros::{get_macro, FwMacro},
         types::{
-            address::Family,
             alias::AliasName,
             ipset::{Ipfilter, IpsetName},
             log::LogRateLimit,
@@ -26,6 +25,8 @@ use proxmox_ve_config::{
     guest::types::Vmid,
 };
 
+use proxmox_network_types::ip_address::Family;
+
 use crate::config::FirewallConfig;
 
 #[derive(Debug, Clone)]
diff --git a/proxmox-nftables/Cargo.toml b/proxmox-nftables/Cargo.toml
index 4ff6f41..85f07f0 100644
--- a/proxmox-nftables/Cargo.toml
+++ b/proxmox-nftables/Cargo.toml
@@ -11,7 +11,7 @@ description = "Proxmox VE nftables"
 license = "AGPL-3"
 
 [features]
-config-ext = ["dep:proxmox-ve-config"]
+config-ext = ["dep:proxmox-ve-config", "dep:proxmox-network-types"]
 
 [dependencies]
 log = "0.4"
@@ -23,3 +23,4 @@ serde_json = "1"
 serde_plain = "1"
 
 proxmox-ve-config = { workspace = true, optional = true }
+proxmox-network-types = { workspace = true, optional = true }
diff --git a/proxmox-nftables/src/expression.rs b/proxmox-nftables/src/expression.rs
index e9ef94f..4794ac1 100644
--- a/proxmox-nftables/src/expression.rs
+++ b/proxmox-nftables/src/expression.rs
@@ -1,17 +1,16 @@
 use crate::types::{ElemConfig, Verdict};
-use proxmox_ve_config::firewall::types::address::IpRange;
 use proxmox_ve_config::host::types::BridgeName;
 use serde::{Deserialize, Serialize};
 use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
 
 #[cfg(feature = "config-ext")]
-use proxmox_ve_config::firewall::types::address::{Family, IpEntry, IpList};
+use proxmox_ve_config::firewall::types::address::{IpEntry, IpList};
 #[cfg(feature = "config-ext")]
 use proxmox_ve_config::firewall::types::port::{PortEntry, PortList};
 #[cfg(feature = "config-ext")]
 use proxmox_ve_config::firewall::types::rule_match::{IcmpCode, IcmpType, Icmpv6Code, Icmpv6Type};
 #[cfg(feature = "config-ext")]
-use proxmox_ve_config::firewall::types::Cidr;
+use proxmox_network_types::ip_address::{Cidr, IpRange, Family};
 
 #[derive(Clone, Debug, Deserialize, Serialize)]
 #[serde(rename_all = "lowercase")]
diff --git a/proxmox-nftables/src/types.rs b/proxmox-nftables/src/types.rs
index 320c757..c613e64 100644
--- a/proxmox-nftables/src/types.rs
+++ b/proxmox-nftables/src/types.rs
@@ -8,7 +8,7 @@ use crate::{Expression, Statement};
 use serde::{Deserialize, Serialize};
 
 #[cfg(feature = "config-ext")]
-use proxmox_ve_config::firewall::types::address::Family;
+use proxmox_network_types::ip_address::Family;
 
 #[cfg(feature = "config-ext")]
 use proxmox_ve_config::firewall::types::ipset::IpsetName;
-- 
2.39.5