From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 5F1771FF187 for ; Mon, 6 Oct 2025 12:20:07 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id BCACD27FB8; Mon, 6 Oct 2025 12:20:10 +0200 (CEST) From: Gabriel Goller To: pve-devel@lists.proxmox.com Date: Mon, 6 Oct 2025 12:19:30 +0200 Message-ID: <20251006101933.90655-3-g.goller@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20251006101933.90655-1-g.goller@proxmox.com> References: <20251006101933.90655-1-g.goller@proxmox.com> MIME-Version: 1.0 X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1759745949705 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.005 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pve-devel] [PATCH ve-rs v2 2/2] fix: firewall: introduce iptables to nftables mapping for icmpv6-types X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" Some of the iptables icmpv6-type options we expose in the UI don't exist in nftables, so we need to make a mapping with a custom type and code to support them. There are also some options that have been renamed in nftables, which can be mapped to the new name: https://wiki.nftables.org/wiki-nftables/index.php/Supported_features_compared_to_xtables#icmp6 Signed-off-by: Gabriel Goller --- proxmox-ve-config/src/firewall/cluster.rs | 9 +-- .../src/firewall/types/rule_match.rs | 72 ++++++++++++++++--- 2 files changed, 66 insertions(+), 15 deletions(-) diff --git a/proxmox-ve-config/src/firewall/cluster.rs b/proxmox-ve-config/src/firewall/cluster.rs index d588302b0783..5e1143fb2617 100644 --- a/proxmox-ve-config/src/firewall/cluster.rs +++ b/proxmox-ve-config/src/firewall/cluster.rs @@ -143,7 +143,7 @@ mod tests { log::{LogLevel, LogRateLimitTimescale}, rule::{Kind, RuleGroup}, rule_match::{ - Icmpv6, Icmpv6Code, IpAddrMatch, IpMatch, Ports, Protocol, RuleMatch, Tcp, Udp, + Icmpv6, Icmpv6Code, Icmpv6Type, IpAddrMatch, IpMatch, Ports, Protocol, RuleMatch, Tcp, Udp }, }; @@ -331,9 +331,10 @@ IN BGP(REJECT) -log crit -source 1.2.3.4 .unwrap() ))), }), - proto: Some(Protocol::Icmpv6(Icmpv6::new_code(Icmpv6Code::Named( - "port-unreachable" - )))), + proto: Some(Protocol::Icmpv6(Icmpv6::new_ty_and_code( + Icmpv6Type::Numeric(1), + Icmpv6Code::Numeric(4) + ))), log: Some(LogLevel::Nolog), ..Default::default() }), diff --git a/proxmox-ve-config/src/firewall/types/rule_match.rs b/proxmox-ve-config/src/firewall/types/rule_match.rs index f99a936b454a..99625d0e31a5 100644 --- a/proxmox-ve-config/src/firewall/types/rule_match.rs +++ b/proxmox-ve-config/src/firewall/types/rule_match.rs @@ -664,10 +664,10 @@ impl Icmpv6 { } } - pub fn new_code(code: Icmpv6Code) -> Self { + pub fn new_ty_and_code(ty: Icmpv6Type, code: Icmpv6Code) -> Self { Self { + ty: Some(ty), code: Some(code), - ..Default::default() } } @@ -695,23 +695,73 @@ enum IcmpTypeMap { Custom((u8, u8)), } +/// Some icmp_types are not supported by nftables. See: +/// https://wiki.nftables.org/wiki-nftables/index.php/Supported_features_compared_to_xtables#icmp6 +/// Some have an exact equivalent in nftables and for some others we need to set a custom type and +/// code combination. +#[sortable] +const IPTABLES_ICMPV6_TYPES_MAPPING: [(&str, IcmpTypeMap); 19] = sorted!([ + ("no-route", IcmpTypeMap::Custom((1, 0))), + ("communication-prohibited", IcmpTypeMap::Custom((1, 1))), + ("beyond-scope", IcmpTypeMap::Custom((1, 2))), + ("address-unreachable", IcmpTypeMap::Custom((1, 3))), + ("port-unreachable", IcmpTypeMap::Custom((1, 4))), + ("failed-policy", IcmpTypeMap::Custom((1, 5))), + ("reject-route'", IcmpTypeMap::Custom((1, 6))), + ("ttl-zero-during-transit", IcmpTypeMap::Custom((3, 0))), + ("ttl-zero-during-reassembly", IcmpTypeMap::Custom((3, 1))), + ("bad-header", IcmpTypeMap::Custom((4, 0))), + ("unknown-header-type", IcmpTypeMap::Custom((4, 1))), + ("unknown-option", IcmpTypeMap::Custom((4, 2))), + ("router-solicitation", IcmpTypeMap::Map("nd-router-solicit")), + ("router-advertisement", IcmpTypeMap::Map("nd-router-advert")), + ( + "neighbor-solicitation", + IcmpTypeMap::Map("nd-neighbor-solicit") + ), + ( + "neighbour-solicitation", + IcmpTypeMap::Map("nd-neighbor-solicit") + ), + ( + "neighbor-advertisement", + IcmpTypeMap::Map("nd-neighbor-advert") + ), + ( + "neighbour-advertisement", + IcmpTypeMap::Map("nd-neighbor-advert") + ), + ("redirect", IcmpTypeMap::Map("nd-redirect")), +]); + impl FromStr for Icmpv6 { type Err = Error; fn from_str(s: &str) -> Result { let mut this = Self::default(); - if let Ok(ty) = s.parse() { - this.ty = Some(ty); - return Ok(this); + // Some icmpv6 types exist in iptables, but do not in nftables. Some of these map exactly + // onto other types, for others we need to use a custom type/code combination. + if let Ok(index) = IPTABLES_ICMPV6_TYPES_MAPPING.binary_search_by(|v| v.0.cmp(s)) { + match IPTABLES_ICMPV6_TYPES_MAPPING[index].1 { + IcmpTypeMap::Map(mapped_nftables_type) => { + this.ty = Some(Icmpv6Type::Named(mapped_nftables_type)); + return Ok(this); + } + IcmpTypeMap::Custom((ty, code)) => { + this.ty = Some(Icmpv6Type::Numeric(ty)); + this.code = Some(Icmpv6Code::Numeric(code)); + return Ok(this); + } + } } - if let Ok(code) = s.parse() { - this.code = Some(code); + if let Ok(ty) = s.parse() { + this.ty = Some(ty); return Ok(this); } - bail!("supplied string is neither a valid icmpv6 type nor code"); + bail!("supplied string is not a valid icmpv6 type"); } } @@ -1015,13 +1065,13 @@ mod tests { } ); - icmp = "admin-prohibited".parse().expect("valid icmpv6 code"); + icmp = "unknown-header-type".parse().expect("valid icmpv6 type"); assert_eq!( icmp, Icmpv6 { - ty: None, - code: Some(Icmpv6Code::Named("admin-prohibited")) + ty: Some(Icmpv6Type::Numeric(4)), + code: Some(Icmpv6Code::Numeric(1)) } ); } -- 2.47.3 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel