From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 2DED91FF187 for ; Mon, 6 Oct 2025 12:19:46 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 234FE27F8B; Mon, 6 Oct 2025 12:19:42 +0200 (CEST) From: Gabriel Goller To: pve-devel@lists.proxmox.com Date: Mon, 6 Oct 2025 12:19:29 +0200 Message-ID: <20251006101933.90655-2-g.goller@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20251006101933.90655-1-g.goller@proxmox.com> References: <20251006101933.90655-1-g.goller@proxmox.com> MIME-Version: 1.0 X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1759745949645 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.005 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pve-devel] [PATCH ve-rs v2 1/2] fix: firewall: introduce iptables to nftables mapping for icmp-types X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Cc: Wolfgang Bumiller Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" From: Wolfgang Bumiller Some of the icmp-type options that we expose in the UI don't exist as standalone nftables options, so we need to create them using a custom type and code id. Signed-off-by: Gabriel Goller --- proxmox-ve-config/src/firewall/types/rule.rs | 9 +-- .../src/firewall/types/rule_match.rs | 67 ++++++++++++++++--- 2 files changed, 63 insertions(+), 13 deletions(-) diff --git a/proxmox-ve-config/src/firewall/types/rule.rs b/proxmox-ve-config/src/firewall/types/rule.rs index 3ad8cf059f09..d20145cb902e 100644 --- a/proxmox-ve-config/src/firewall/types/rule.rs +++ b/proxmox-ve-config/src/firewall/types/rule.rs @@ -254,7 +254,7 @@ mod tests { alias::{AliasName, AliasScope}, ipset::{IpsetName, IpsetScope}, log::LogLevel, - rule_match::{Icmp, IcmpCode, IpAddrMatch, IpMatch, Ports, Protocol, Udp}, + rule_match::{Icmp, IcmpCode, IcmpType, IpAddrMatch, IpMatch, Ports, Protocol, Udp}, }; use super::*; @@ -338,9 +338,10 @@ mod tests { ), ) .ok(), - proto: Some(Protocol::Icmp(Icmp::new_code(IcmpCode::Named( - "port-unreachable" - )))), + proto: Some(Protocol::Icmp(Icmp::new_ty_and_code( + IcmpType::Numeric(3), + IcmpCode::Numeric(3) + ))), log: Some(LogLevel::Nolog), ..Default::default() }), diff --git a/proxmox-ve-config/src/firewall/types/rule_match.rs b/proxmox-ve-config/src/firewall/types/rule_match.rs index 7fcd35c80d86..f99a936b454a 100644 --- a/proxmox-ve-config/src/firewall/types/rule_match.rs +++ b/proxmox-ve-config/src/firewall/types/rule_match.rs @@ -463,10 +463,10 @@ impl Icmp { } } - pub fn new_code(code: IcmpCode) -> Self { + pub fn new_ty_and_code(ty: IcmpType, code: IcmpCode) -> Self { Self { + ty: Some(ty), code: Some(code), - ..Default::default() } } @@ -487,19 +487,61 @@ impl Icmp { } } +/// Some icmp_types are not supported by nftables. See: +/// https://wiki.nftables.org/wiki-nftables/index.php/Supported_features_compared_to_xtables#icmp +/// Some have an exact equivalent in nftables and for some others we need to set a custom type and +/// code combination. +#[sortable] +const IPTABLES_ICMP_TYPES_MAPPING: [(&str, IcmpTypeMap); 23] = sorted!([ + ("network-unreachable", IcmpTypeMap::Custom((3, 0))), + ("host-unreachable", IcmpTypeMap::Custom((3, 1))), + ("protocol-unreachable", IcmpTypeMap::Custom((3, 2))), + ("port-unreachable", IcmpTypeMap::Custom((3, 3))), + ("fragmentation-needed", IcmpTypeMap::Custom((3, 4))), + ("source-route-failed", IcmpTypeMap::Custom((3, 5))), + ("network-unknown", IcmpTypeMap::Custom((3, 6))), + ("host-unknown", IcmpTypeMap::Custom((3, 7))), + ("network-prohibited", IcmpTypeMap::Custom((3, 9))), + ("host-prohibited", IcmpTypeMap::Custom((3, 10))), + ("TOS-network-unreachable", IcmpTypeMap::Custom((3, 11))), + ("TOS-host-unreachable", IcmpTypeMap::Custom((3, 12))), + ("communication-prohibited", IcmpTypeMap::Custom((3, 13))), + ("host-precedence-violation", IcmpTypeMap::Custom((3, 14))), + ("precedence-cutoff", IcmpTypeMap::Custom((3, 15))), + ("network-redirect", IcmpTypeMap::Custom((5, 0))), + ("host-redirect", IcmpTypeMap::Custom((5, 1))), + ("TOS-network-redirect", IcmpTypeMap::Custom((5, 2))), + ("TOS-host-redirect", IcmpTypeMap::Custom((5, 3))), + ("ttl-zero-during-transit", IcmpTypeMap::Custom((11, 0))), + ("ttl-zero-during-reassembly", IcmpTypeMap::Custom((11, 1))), + ("ip-header-bad", IcmpTypeMap::Custom((12, 0))), + ("required-option-missing", IcmpTypeMap::Custom((12, 1))), +]); + impl FromStr for Icmp { type Err = Error; fn from_str(s: &str) -> Result { let mut this = Self::default(); - if let Ok(ty) = s.parse() { - this.ty = Some(ty); - return Ok(this); + // Some icmp types exist in iptables, but do not in nftables. Some of these map exactly + // onto other types, for others we need to use a custom type/code combination. + if let Ok(index) = IPTABLES_ICMP_TYPES_MAPPING.binary_search_by(|v| v.0.cmp(s)) { + match IPTABLES_ICMP_TYPES_MAPPING[index].1 { + IcmpTypeMap::Map(mapped_nftables_type) => { + this.ty = Some(IcmpType::Named(mapped_nftables_type)); + return Ok(this); + } + IcmpTypeMap::Custom((ty, code)) => { + this.ty = Some(IcmpType::Numeric(ty)); + this.code = Some(IcmpCode::Numeric(code)); + return Ok(this); + } + } } - if let Ok(code) = s.parse() { - this.code = Some(code); + if let Ok(ty) = s.parse() { + this.ty = Some(ty); return Ok(this); } @@ -646,6 +688,13 @@ impl Icmpv6 { } } +enum IcmpTypeMap { + /// This icmp type can be mapped exactly to an equivalent nftables type + Map(&'static str), + /// This icmp type needs to be represented using a custom type and code combination + Custom((u8, u8)), +} + impl FromStr for Icmpv6 { type Err = Error; @@ -938,8 +987,8 @@ mod tests { assert_eq!( icmp, Icmp { - ty: None, - code: Some(IcmpCode::Named("port-unreachable")) + ty: Some(IcmpType::Numeric(3)), + code: Some(IcmpCode::Numeric(3)) } ); } -- 2.47.3 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel