[pve-devel] [PATCH v1 pve-firewall] simulator: ignore CONNMARK --set-mark targets to fix broken tests

[Robert Obkircher]

These targets mark connections with the VMID. The value can just be
ignored because the simulator doesn't support restoring it later.

Signed-off-by: Robert Obkircher <r.obkircher at proxmox.com>
---
 src/PVE/FirewallSimulator.pm | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/PVE/FirewallSimulator.pm b/src/PVE/FirewallSimulator.pm
index 0a3100b..cc84d0b 100644
--- a/src/PVE/FirewallSimulator.pm
+++ b/src/PVE/FirewallSimulator.pm
@@ -253,6 +253,10 @@ sub rule_match {
             return undef;
         }
 
+        if ($rule =~ s@^-j CONNMARK --set-mark ($NUMBER_RE)(?:/($NUMBER_RE))?\s*$@@) {
+            return undef;
+        }
+
         if ($rule =~ s/^-j (\S+)\s*$//) {
             return (0, $1);
         }
-- 
2.47.3