[pve-devel] [PATCH proxmox-firewall/ve-rs v2 0/3] Fix ICMP types in nftables

[Stefan Hanreich]

tested this series and found another pre-existing issue with rule
generation, which I sent a patch for [1].

Together with the patch series I sent applied, this patch series solves
the issues on my test instance. Code LGTM as well - so consider this:

Tested-by: Stefan Hanreich <s.hanreich at proxmox.com>
Reviewed-by: Stefan Hanreich <s.hanreich at proxmox.com>


[1]
https://lore.proxmox.com/pve-devel/20251008131457.178090-1-s.hanreich@proxmox.com/T/#t

On 10/6/25 12:19 PM, Gabriel Goller wrote:
> Currently when setting ICMP types on the old firewall (iptables) then
> switching to the new one (nftables) a few types will fail because they have
> been renamed in nftables or do not exist in nftables. This affects both icmp
> and icmpv6 where we now map options that do not exist in nftables to their
> respective type/code combinations. This allows us to have exactly the same
> behavior in nftables as we have in iptables.
> 
> Changelog:
> v1, thanks Stefan and Thomas:
>  * no hard error when mapping not possible
>  * map all the types by falling back to custom type/code
>  * also map icmp types in addition to icmpv6
> 
> ve-rs:
> 
> Gabriel Goller (1):
>   fix: firewall: introduce iptables to nftables mapping for icmpv6-types
> 
> Wolfgang Bumiller (1):
>   fix: firewall: introduce iptables to nftables mapping for icmp-types
> 
>  proxmox-ve-config/src/firewall/cluster.rs     |   9 +-
>  proxmox-ve-config/src/firewall/types/rule.rs  |   9 +-
>  .../src/firewall/types/rule_match.rs          | 139 +++++++++++++++---
>  3 files changed, 129 insertions(+), 28 deletions(-)
> 
> 
> proxmox-firewall:
> 
> Gabriel Goller (1):
>   tests: add icmpv6 type mapping test
> 
>  proxmox-firewall/tests/input/host.fw          |  1 +
>  .../integration_tests__firewall.snap          | 63 +++++++++++++++++++
>  2 files changed, 64 insertions(+)
> 
> 
> Summary over all repositories:
>   5 files changed, 193 insertions(+), 28 deletions(-)
>