[pve-devel] [PATCH ve-rs 1/2] fix: firewall: introduce iptables to nftables mapping for icmpv6-types

[Gabriel Goller]

nftables changed the names of the icmpv6-types and they don't overlap
completely with the old iptables names. Introduce a mapping that
converts old names into the new ones. A few of these are not supported,
see here for more info:
https://wiki.nftables.org/wiki-nftables/index.php/Supported_features_compared_to_xtables#icmp6

Signed-off-by: Gabriel Goller <g.goller at proxmox.com>
---
 .../src/firewall/types/rule_match.rs          | 33 +++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/proxmox-ve-config/src/firewall/types/rule_match.rs b/proxmox-ve-config/src/firewall/types/rule_match.rs
index 7fcd35c80d86..8202cda57895 100644
--- a/proxmox-ve-config/src/firewall/types/rule_match.rs
+++ b/proxmox-ve-config/src/firewall/types/rule_match.rs
@@ -697,6 +697,31 @@ const ICMPV6_TYPES: [(&str, u8); 19] = sorted!([
     ("time-exceeded", 3),
 ]);
 
+/// Some icmp_types are not supported by nftables. See:
+/// https://wiki.nftables.org/wiki-nftables/index.php/Supported_features_compared_to_xtables#icmp6
+#[sortable]
+const IPTABLES_ICMP_TYPES_MAPPING: [(&str, Option<&str>); 19] = sorted!([
+    ("no-route", None),
+    ("communication-prohibited", None),
+    ("beyond-scope", None),
+    ("address-unreachable", None),
+    ("port-unreachable", None),
+    ("failed-policy", None),
+    ("reject-route'", None),
+    ("ttl-zero-during-transit", None),
+    ("ttl-zero-during-reassembly", None),
+    ("bad-header", None),
+    ("unknown-header-type", None),
+    ("unknown-option", None),
+    ("router-solicitation", Some("nd-router-solicit")),
+    ("router-advertisement", Some("nd-router-advert")),
+    ("neighbor-solicitation", Some("nd-neighbor-solicit")),
+    ("neighbour-solicitation", Some("nd-neighbor-solicit")),
+    ("neighbor-advertisement", Some("nd-neighbor-advert")),
+    ("neighbour-advertisement", Some("nd-neighbor-advert")),
+    ("redirect", Some("nd-redirect")),
+]);
+
 impl std::str::FromStr for Icmpv6Type {
     type Err = Error;
 
@@ -713,6 +738,14 @@ impl std::str::FromStr for Icmpv6Type {
             return Ok(Self::Named(ICMPV6_TYPES[index].0));
         }
 
+        if let Ok(index) = IPTABLES_ICMP_TYPES_MAPPING.binary_search_by(|v| v.0.cmp(s)) {
+            if let Some(mapped_nftables_type) = IPTABLES_ICMP_TYPES_MAPPING[index].1 {
+                return Ok(Self::Named(mapped_nftables_type));
+            } else {
+                bail!("icmp_type {s:?} is unsupported in nftables");
+            }
+        }
+
         bail!("{s:?} is not a valid icmpv6 type");
     }
 }
-- 
2.47.3