[RFC proxmox 08/22] firewall-api-types: add FirewallNodeOptions struct

[Dietmar Maurer <dietmar@proxmox.com>]

Adds the FirewallNodeOptions struct for node-level firewall configuration,
including settings for host firewall enablement, conntrack parameters,
NDP, synflood protection, SMURF filter, TCP flags, and various log level
options. Uses perl-compatible deserialization for boolean/numeric fields.

Extracted form perl api, but replaced Vec<FirewallConntrackHelper> with new
<CommaSeparatedList<FirewallConntrackHelper>> helper type.

Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
---
 proxmox-firewall-api-types/src/lib.rs         |   3 +
 .../src/node_options.rs                       | 240 ++++++++++++++++++
 2 files changed, 243 insertions(+)
 create mode 100644 proxmox-firewall-api-types/src/node_options.rs

diff --git a/proxmox-firewall-api-types/src/lib.rs b/proxmox-firewall-api-types/src/lib.rs
index c6fc9ebb..ef672bfe 100644
--- a/proxmox-firewall-api-types/src/lib.rs
+++ b/proxmox-firewall-api-types/src/lib.rs
@@ -14,3 +14,6 @@ pub use cluster_options::FirewallClusterOptions;
 
 mod guest_options;
 pub use guest_options::FirewallGuestOptions;
+
+mod node_options;
+pub use node_options::FirewallNodeOptions;
diff --git a/proxmox-firewall-api-types/src/node_options.rs b/proxmox-firewall-api-types/src/node_options.rs
new file mode 100644
index 00000000..b7873904
--- /dev/null
+++ b/proxmox-firewall-api-types/src/node_options.rs
@@ -0,0 +1,240 @@
+use super::{FirewallConntrackHelper, FirewallLogLevel};
+use proxmox_schema::api;
+use proxmox_schema::comma_separated_list::CommaSeparatedList;
+
+#[api(
+    properties: {
+        enable: {
+            default: true,
+            optional: true,
+        },
+        log_level_forward: {
+            optional: true,
+            type: FirewallLogLevel,
+        },
+        log_level_in: {
+            optional: true,
+            type: FirewallLogLevel,
+        },
+        log_level_out: {
+            optional: true,
+            type: FirewallLogLevel,
+        },
+        log_nf_conntrack: {
+            default: false,
+            optional: true,
+        },
+        ndp: {
+            default: true,
+            optional: true,
+        },
+        nf_conntrack_allow_invalid: {
+            default: false,
+            optional: true,
+        },
+        nf_conntrack_helpers: {
+            optional: true,
+        },
+        nf_conntrack_max: {
+            default: 262144,
+            minimum: 32768,
+            optional: true,
+            type: Integer,
+        },
+        nf_conntrack_tcp_timeout_established: {
+            default: 432000,
+            minimum: 7875,
+            optional: true,
+            type: Integer,
+        },
+        nf_conntrack_tcp_timeout_syn_recv: {
+            default: 60,
+            maximum: 60,
+            minimum: 30,
+            optional: true,
+            type: Integer,
+        },
+        nftables: {
+            default: false,
+            optional: true,
+        },
+        nosmurfs: {
+            default: false,
+            optional: true,
+        },
+        protection_synflood: {
+            default: false,
+            optional: true,
+        },
+        protection_synflood_burst: {
+            default: 1000,
+            optional: true,
+            type: Integer,
+        },
+        protection_synflood_rate: {
+            default: 200,
+            optional: true,
+            type: Integer,
+        },
+        smurf_log_level: {
+            optional: true,
+            type: FirewallLogLevel,
+        },
+        tcp_flags_log_level: {
+            optional: true,
+            type: FirewallLogLevel,
+        },
+        tcpflags: {
+            default: false,
+            optional: true,
+        },
+    },
+)]
+/// Node Firewall Options
+#[derive(Debug, serde::Deserialize, serde::Serialize)]
+pub struct FirewallNodeOptions {
+    /// Enable host firewall rules.
+    #[serde(deserialize_with = "proxmox_serde::perl::deserialize_bool")]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub enable: Option<bool>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub log_level_forward: Option<FirewallLogLevel>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub log_level_in: Option<FirewallLogLevel>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub log_level_out: Option<FirewallLogLevel>,
+
+    /// Enable logging of conntrack information.
+    #[serde(deserialize_with = "proxmox_serde::perl::deserialize_bool")]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub log_nf_conntrack: Option<bool>,
+
+    /// Enable NDP (Neighbor Discovery Protocol).
+    #[serde(deserialize_with = "proxmox_serde::perl::deserialize_bool")]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ndp: Option<bool>,
+
+    /// Allow invalid packets on connection tracking.
+    #[serde(deserialize_with = "proxmox_serde::perl::deserialize_bool")]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub nf_conntrack_allow_invalid: Option<bool>,
+
+    /// Enable conntrack helpers for specific protocols. Supported protocols:
+    /// amanda, ftp, irc, netbios-ns, pptp, sane, sip, snmp, tftp
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub nf_conntrack_helpers: Option<CommaSeparatedList<FirewallConntrackHelper>>,
+
+    /// Maximum number of tracked connections.
+    #[serde(deserialize_with = "proxmox_serde::perl::deserialize_u64")]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub nf_conntrack_max: Option<u64>,
+
+    /// Conntrack established timeout.
+    #[serde(deserialize_with = "proxmox_serde::perl::deserialize_u64")]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub nf_conntrack_tcp_timeout_established: Option<u64>,
+
+    /// Conntrack syn recv timeout.
+    #[serde(deserialize_with = "proxmox_serde::perl::deserialize_u8")]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub nf_conntrack_tcp_timeout_syn_recv: Option<u8>,
+
+    /// Enable nftables based firewall (tech preview)
+    #[serde(deserialize_with = "proxmox_serde::perl::deserialize_bool")]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub nftables: Option<bool>,
+
+    /// Enable SMURFS filter.
+    #[serde(deserialize_with = "proxmox_serde::perl::deserialize_bool")]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub nosmurfs: Option<bool>,
+
+    /// Enable synflood protection
+    #[serde(deserialize_with = "proxmox_serde::perl::deserialize_bool")]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub protection_synflood: Option<bool>,
+
+    /// Synflood protection rate burst by ip src.
+    #[serde(deserialize_with = "proxmox_serde::perl::deserialize_i64")]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub protection_synflood_burst: Option<i64>,
+
+    /// Synflood protection rate syn/sec by ip src.
+    #[serde(deserialize_with = "proxmox_serde::perl::deserialize_i64")]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub protection_synflood_rate: Option<i64>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub smurf_log_level: Option<FirewallLogLevel>,
+
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub tcp_flags_log_level: Option<FirewallLogLevel>,
+
+    /// Filter illegal combinations of TCP flags.
+    #[serde(deserialize_with = "proxmox_serde::perl::deserialize_bool")]
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub tcpflags: Option<bool>,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_conntrack_list() {
+        let ok_tests = vec![
+            ("", None, ""),
+            (
+                "ftp",
+                Some(CommaSeparatedList::new(vec![FirewallConntrackHelper::Ftp])),
+                "ftp",
+            ),
+            (
+                "ftp,pptp",
+                Some(CommaSeparatedList::new(vec![
+                    FirewallConntrackHelper::Ftp,
+                    FirewallConntrackHelper::Pptp,
+                ])),
+                "ftp,pptp",
+            ),
+            (
+                ",,ftp;pptp;;;",
+                Some(CommaSeparatedList::new(vec![
+                    FirewallConntrackHelper::Ftp,
+                    FirewallConntrackHelper::Pptp,
+                ])),
+                "ftp,pptp",
+            ),
+            (
+                "ftp\0pptp\0",
+                Some(CommaSeparatedList::new(vec![
+                    FirewallConntrackHelper::Ftp,
+                    FirewallConntrackHelper::Pptp,
+                ])),
+                "ftp,pptp",
+            ),
+        ];
+
+        for (input, expected, expected_str) in ok_tests {
+            let helpers: Option<CommaSeparatedList<FirewallConntrackHelper>> =
+                serde_plain::from_str(input).unwrap();
+            assert_eq!(helpers, expected);
+            assert_eq!(serde_plain::to_string(&helpers).unwrap(), expected_str);
+        }
+    }
+
+    #[test]
+    #[cfg(not(feature = "enum-fallback"))]
+    fn test_conntrack_list_unknown() {
+        let err_tests = vec!["unknown", "ftp,Unknown", "ftp,pptp,un-known"];
+
+        for input in err_tests {
+            let helpers: Result<Option<CommaSeparatedList<FirewallConntrackHelper>>, _> =
+                serde_plain::from_str(input);
+            assert!(helpers.is_err());
+        }
+    }
+}
-- 
2.47.3