From: Hannes Laimer <h.laimer@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [PATCH pve-manager v3 38/45] ui: sdn: microseg: add narrowing to the rule form
Date: Tue, 27 Oct 2026 09:55:20 +0100 [thread overview]
Message-ID: <20261027085527.702738-39-h.laimer@proxmox.com> (raw)
In-Reply-To: <20261027085527.702738-1-h.laimer@proxmox.com>
Reuse the firewall's macro, protocol and ICMP type selectors, so a
narrowed rule is entered the same way as a firewall rule.
Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
www/manager6/grid/FirewallRules.js | 2 +
www/manager6/sdn/microseg/RuleEdit.js | 111 +++++++++++++++++++++++++-
www/manager6/sdn/microseg/RuleView.js | 42 +++++++++-
3 files changed, 151 insertions(+), 4 deletions(-)
diff --git a/www/manager6/grid/FirewallRules.js b/www/manager6/grid/FirewallRules.js
index 0db817ebce0e..d408bd00b7f0 100644
--- a/www/manager6/grid/FirewallRules.js
+++ b/www/manager6/grid/FirewallRules.js
@@ -81,6 +81,7 @@ Ext.define('PVE.form.ICMPTypeSelector', {
});
let ICMP_TYPE_NAMES_STORE = Ext.create('Ext.data.Store', {
+ storeId: 'pve-icmp-type-names',
field: ['type', 'name'],
data: [
{ type: 'any', name: 'any' },
@@ -123,6 +124,7 @@ let ICMP_TYPE_NAMES_STORE = Ext.create('Ext.data.Store', {
],
});
let ICMPV6_TYPE_NAMES_STORE = Ext.create('Ext.data.Store', {
+ storeId: 'pve-icmpv6-type-names',
field: ['type', 'name'],
data: [
{ type: '1', name: 'destination-unreachable' },
diff --git a/www/manager6/sdn/microseg/RuleEdit.js b/www/manager6/sdn/microseg/RuleEdit.js
index 4ec5467f61be..3ee9c3b36e46 100644
--- a/www/manager6/sdn/microseg/RuleEdit.js
+++ b/www/manager6/sdn/microseg/RuleEdit.js
@@ -60,6 +60,37 @@ Ext.define('PVE.sdn.microseg.RuleInputPanel', {
},
});
+ let setNarrowing = (field, enabled, clear) => {
+ field.setDisabled(!enabled);
+ if (clear) {
+ field.setValue('');
+ }
+ };
+ let updateNarrowing = () => {
+ let macro = me.down('field[name=macro]');
+ let proto = me.down('field[name=proto]');
+ let byMacro = !Ext.isEmpty(macro.getValue());
+ if (me.isCreate) {
+ setNarrowing(proto, !byMacro, byMacro);
+ }
+ let editable = me.isCreate && !byMacro;
+ let protocol = proto.getValue();
+ let icmpv4 = protocol === 'icmp';
+ let icmpv6 = protocol === 'icmpv6' || protocol === 'ipv6-icmp';
+ let v4 = me.down('#microsegIcmpv4Type');
+ let v6 = me.down('#microsegIcmpv6Type');
+ v4.setHidden(!icmpv4);
+ setNarrowing(v4, icmpv4 && editable);
+ v6.setHidden(!icmpv6);
+ setNarrowing(v6, icmpv6 && editable);
+ let ports = !icmpv4 && !icmpv6;
+ for (const name of ['sport', 'dport']) {
+ let field = me.down(`field[name=${name}]`);
+ field.setHidden(!ports);
+ setNarrowing(field, ports && editable, me.isCreate && !editable);
+ }
+ };
+
me.column1 = [
me.srcSelector,
{
@@ -76,6 +107,69 @@ Ext.define('PVE.sdn.microseg.RuleInputPanel', {
},
},
},
+ {
+ xtype: 'displayfield',
+ fieldLabel: '',
+ height: 7,
+ value: '',
+ },
+ {
+ xtype: 'proxmoxtextfield',
+ name: 'sport',
+ fieldLabel: gettext('Source port'),
+ disabled: !me.isCreate,
+ },
+ {
+ xtype: 'pveICMPTypeSelector',
+ name: 'icmp-type',
+ itemId: 'microsegIcmpv4Type',
+ autoSelect: false,
+ editable: true,
+ hidden: true,
+ disabled: true,
+ value: '',
+ skipEmptyText: true,
+ fieldLabel: gettext('ICMP type'),
+ store: 'pve-icmp-type-names',
+ },
+ {
+ xtype: 'pveICMPTypeSelector',
+ name: 'icmp-type',
+ itemId: 'microsegIcmpv6Type',
+ autoSelect: false,
+ editable: true,
+ hidden: true,
+ disabled: true,
+ value: '',
+ skipEmptyText: true,
+ fieldLabel: gettext('ICMP type'),
+ store: 'pve-icmpv6-type-names',
+ },
+ {
+ xtype: 'pveFWMacroSelector',
+ name: 'macro',
+ fieldLabel: gettext('Macro'),
+ editable: true,
+ allowBlank: true,
+ skipEmptyText: true,
+ disabled: !me.isCreate,
+ listeners: {
+ change: updateNarrowing,
+ },
+ },
+ {
+ xtype: 'pveIPProtocolSelector',
+ name: 'proto',
+ autoSelect: false,
+ editable: true,
+ value: '',
+ skipEmptyText: true,
+ fieldLabel: gettext('Protocol'),
+ disabled: !me.isCreate,
+ listeners: {
+ change: updateNarrowing,
+ },
+ },
{
xtype: 'proxmoxcheckbox',
name: 'bidirectional',
@@ -85,7 +179,7 @@ Ext.define('PVE.sdn.microseg.RuleInputPanel', {
autoEl: {
tag: 'div',
'data-qtip': gettext(
- 'Also apply the rule with source and destination swapped.',
+ 'Also apply the rule with source and destination swapped, ports included.',
),
},
},
@@ -108,6 +202,19 @@ Ext.define('PVE.sdn.microseg.RuleInputPanel', {
},
},
},
+ {
+ xtype: 'displayfield',
+ fieldLabel: '',
+ height: 7,
+ value: '',
+ },
+ {
+ xtype: 'proxmoxtextfield',
+ name: 'dport',
+ fieldLabel: gettext('Dest. port'),
+ hideMode: 'visibility',
+ disabled: !me.isCreate,
+ },
{
xtype: 'proxmoxintegerfield',
name: 'prio',
@@ -119,7 +226,7 @@ Ext.define('PVE.sdn.microseg.RuleInputPanel', {
autoEl: {
tag: 'div',
'data-qtip': gettext(
- 'The highest priority wins. At a tie, the most specific rules decide and a deny wins among equals.',
+ 'The highest priority wins. At a tie, the most specific rules decide and a deny wins among equals. A narrowed rule is checked ahead of one without any narrowing at the same priority.',
),
},
},
diff --git a/www/manager6/sdn/microseg/RuleView.js b/www/manager6/sdn/microseg/RuleView.js
index 57ca0eddc1c9..016e1dc4455e 100644
--- a/www/manager6/sdn/microseg/RuleView.js
+++ b/www/manager6/sdn/microseg/RuleView.js
@@ -36,6 +36,7 @@ Ext.define(
inbound = sel.inbound.has(data.id);
}
return {
+ rank: me.rankOf(data),
direction: out && inbound ? 'both' : out ? 'out' : inbound ? 'in' : '',
};
},
@@ -91,7 +92,10 @@ Ext.define(
sortProperty: 'prio',
direction: 'DESC',
},
- sorters: [{ property: 'id', direction: 'ASC' }],
+ sorters: [
+ { property: 'rank', direction: 'ASC' },
+ { property: 'id', direction: 'ASC' },
+ ],
});
let matchWords = {
@@ -149,6 +153,26 @@ Ext.define(
return rec.data.bidirectional ? bothWaysIcon : arrowIcon;
};
+ let matchText = (rec) => {
+ let data = rec.data;
+ if (data.macro) {
+ return data.macro;
+ }
+ let proto = data.proto;
+ if (!proto) {
+ return '';
+ }
+ let text = proto;
+ if (data['icmp-type']) {
+ text += ` ${data['icmp-type']}`;
+ } else if (data.sport) {
+ text += ` ${data.sport} -> ${data.dport || '*'}`;
+ } else if (data.dport) {
+ text += `/${data.dport}`;
+ }
+ return text;
+ };
+
let ruleName = (rec) => {
let arrow = rec.data.bidirectional ? '<->' : '->';
let src = PVE.Utils.format_sdnmicroseg_predicate(
@@ -159,7 +183,9 @@ Ext.define(
rec.data['dst-match'],
rec.data.dst,
);
- return `${src} ${arrow} ${dst}`;
+ let name = `${src} ${arrow} ${dst}`;
+ let match = matchText(rec);
+ return match ? `${name} (${match})` : name;
};
me.columns = [
@@ -189,6 +215,12 @@ Ext.define(
flex: 2,
renderer: (v, m, rec) => renderPredicate(rec.data['dst-match'], v),
},
+ {
+ text: gettext('Match'),
+ dataIndex: 'proto',
+ flex: 1,
+ renderer: (v, m, rec) => Ext.String.htmlEncode(matchText(rec)),
+ },
{ xtype: 'pveSDNMicrosegStateColumn' },
{
text: gettext('Comment'),
@@ -235,7 +267,13 @@ Ext.define(
'prio',
'allow',
'bidirectional',
+ 'proto',
+ 'sport',
+ 'dport',
+ 'icmp-type',
+ 'macro',
'direction',
+ 'rank',
],
});
},
--
2.47.3
next prev parent reply other threads:[~2026-10-27 9:01 UTC|newest]
Thread overview: 46+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-27 8:54 [PATCH access-control/cluster/container/docs/manager/network/proxmox{-ebpf,-ve-rs,-perl-rs}/qemu-server v3 00/45] sdn: add microsegmentation support Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ebpf v3 01/45] build: keep the build directory out of the BPF objects Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ebpf v3 02/45] policy: add the enforcement subsystem for guest interfaces Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ebpf v3 03/45] policy: add a check for non-first fragments Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 04/45] ve-config: firewall: add a constructor for sctp matches Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 05/45] ve-config: sdn: microseg: add identity allocation for group sets Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 06/45] ve-config: sdn: microseg: add config types Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 07/45] ve-config: sdn: microseg: add tag matcher Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 08/45] ve-config: sdn: microseg: add name regex matcher Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 09/45] ve-config: sdn: microseg: narrow rules by protocol and ports Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 10/45] ve-config: sdn: microseg: add group hierarchy Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 11/45] ve-config: firewall: expose protocol, icmp type and code numbers Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 12/45] ve-config: sdn: microseg: add the desired state Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 13/45] microseg: add a crate that applies the policy to a node's guest NICs Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-ve-rs v3 14/45] microseg: add a rule option that matches non-first fragments Hannes Laimer
2026-10-27 8:54 ` [PATCH pve-cluster v3 15/45] cfs: add 'sdn/microseg.cfg' to observed files Hannes Laimer
2026-10-27 8:54 ` [PATCH pve-access-control v3 16/45] permissions: add ACL path for SDN microsegmentation Hannes Laimer
2026-10-27 8:54 ` [PATCH proxmox-perl-rs v3 17/45] pve-rs: sdn: add microseg config binding Hannes Laimer
2026-10-27 8:55 ` [PATCH proxmox-perl-rs v3 18/45] pve-rs: sdn: microseg: bind the data plane Hannes Laimer
2026-10-27 8:55 ` [PATCH proxmox-perl-rs v3 19/45] pve-rs: sdn: microseg: check the data plane limits on render Hannes Laimer
2026-10-27 8:55 ` [PATCH proxmox-perl-rs v3 20/45] pve-rs: debian: fire the pve-microseg-update trigger on upgrade Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-network v3 21/45] sdn: zones: add vxlan-gbp option to vxlan and evpn zones Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-network v3 22/45] sdn: microseg: add config, API and guest inventory Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-network v3 23/45] sdn: dry-run: show pending microseg changes Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-network v3 24/45] sdn: microseg: enforce the policy on guest NICs Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-network v3 25/45] sdn: microseg: add tag matcher Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-network v3 26/45] sdn: microseg: add name regex matcher Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-network v3 27/45] sdn: microseg: add an update for a running NIC Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-network v3 28/45] sdn: microseg: expose protocol, port and macro rule options Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-network v3 29/45] sdn: microseg: allow nesting groups under a parent Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-network v3 30/45] sdn: microseg: expose the fragments rule option Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-manager v3 31/45] network: apply the microseg policy on reload Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-manager v3 32/45] pve-sdn-commit: apply the microseg policy at boot Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-manager v3 33/45] ui: sdn: zones: add vxlan-gbp checkbox to vxlan and evpn Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-manager v3 34/45] ui: sdn: add microsegmentation panel Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-manager v3 35/45] ui: sdn: dry-run: show pending microseg diff Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-manager v3 36/45] ui: sdn: microseg: add tag matcher Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-manager v3 37/45] ui: sdn: microseg: add name regex matcher Hannes Laimer
2026-10-27 8:55 ` Hannes Laimer [this message]
2026-10-27 8:55 ` [PATCH pve-manager v3 39/45] ui: sdn: microseg: show and edit the group hierarchy Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-manager v3 40/45] ui: sdn: microseg: add fragments option to the rule form Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-manager v3 41/45] ui: sdn: microseg: add a guest tab with its groups and rules Hannes Laimer
2026-10-27 8:55 ` [PATCH qemu-server v3 42/45] network: update the microseg enforcement on a tag or name change Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-container v3 43/45] lxc: update the microseg enforcement on a tag or hostname change Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-docs v3 44/45] sdn: zones: document the VXLAN-GBP option Hannes Laimer
2026-10-27 8:55 ` [PATCH pve-docs v3 45/45] sdn: add microsegmentation section Hannes Laimer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261027085527.702738-39-h.laimer@proxmox.com \
--to=h.laimer@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox