From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 709031FF16F for ; Tue, 16 Sep 2025 11:32:10 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 62E44EF05; Tue, 16 Sep 2025 11:31:56 +0200 (CEST) From: Gabriel Goller To: pve-devel@lists.proxmox.com Date: Tue, 16 Sep 2025 11:31:10 +0200 Message-ID: <20250916093116.114942-2-g.goller@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250916093116.114942-1-g.goller@proxmox.com> References: <20250916093116.114942-1-g.goller@proxmox.com> MIME-Version: 1.0 X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1758015072988 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.005 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [nftables.org] Subject: [pve-devel] [PATCH ve-rs 1/2] fix: firewall: introduce iptables to nftables mapping for icmpv6-types X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" nftables changed the names of the icmpv6-types and they don't overlap completely with the old iptables names. Introduce a mapping that converts old names into the new ones. A few of these are not supported, see here for more info: https://wiki.nftables.org/wiki-nftables/index.php/Supported_features_compared_to_xtables#icmp6 Signed-off-by: Gabriel Goller --- .../src/firewall/types/rule_match.rs | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/proxmox-ve-config/src/firewall/types/rule_match.rs b/proxmox-ve-config/src/firewall/types/rule_match.rs index 7fcd35c80d86..8202cda57895 100644 --- a/proxmox-ve-config/src/firewall/types/rule_match.rs +++ b/proxmox-ve-config/src/firewall/types/rule_match.rs @@ -697,6 +697,31 @@ const ICMPV6_TYPES: [(&str, u8); 19] = sorted!([ ("time-exceeded", 3), ]); +/// Some icmp_types are not supported by nftables. See: +/// https://wiki.nftables.org/wiki-nftables/index.php/Supported_features_compared_to_xtables#icmp6 +#[sortable] +const IPTABLES_ICMP_TYPES_MAPPING: [(&str, Option<&str>); 19] = sorted!([ + ("no-route", None), + ("communication-prohibited", None), + ("beyond-scope", None), + ("address-unreachable", None), + ("port-unreachable", None), + ("failed-policy", None), + ("reject-route'", None), + ("ttl-zero-during-transit", None), + ("ttl-zero-during-reassembly", None), + ("bad-header", None), + ("unknown-header-type", None), + ("unknown-option", None), + ("router-solicitation", Some("nd-router-solicit")), + ("router-advertisement", Some("nd-router-advert")), + ("neighbor-solicitation", Some("nd-neighbor-solicit")), + ("neighbour-solicitation", Some("nd-neighbor-solicit")), + ("neighbor-advertisement", Some("nd-neighbor-advert")), + ("neighbour-advertisement", Some("nd-neighbor-advert")), + ("redirect", Some("nd-redirect")), +]); + impl std::str::FromStr for Icmpv6Type { type Err = Error; @@ -713,6 +738,14 @@ impl std::str::FromStr for Icmpv6Type { return Ok(Self::Named(ICMPV6_TYPES[index].0)); } + if let Ok(index) = IPTABLES_ICMP_TYPES_MAPPING.binary_search_by(|v| v.0.cmp(s)) { + if let Some(mapped_nftables_type) = IPTABLES_ICMP_TYPES_MAPPING[index].1 { + return Ok(Self::Named(mapped_nftables_type)); + } else { + bail!("icmp_type {s:?} is unsupported in nftables"); + } + } + bail!("{s:?} is not a valid icmpv6 type"); } } -- 2.47.3 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel