* [pve-devel] [PATCH proxmox-firewall] config: nftables: add support for icmp-type any
@ 2024-04-25 17:16 Stefan Hanreich
2024-04-25 17:32 ` [pve-devel] applied: " Thomas Lamprecht
0 siblings, 1 reply; 2+ messages in thread
From: Stefan Hanreich @ 2024-04-25 17:16 UTC (permalink / raw)
To: pve-devel
We support any as wildcard for matching all icmp types. Implement
parsing logic for parsing the any value and support converting the any
value into an nftables expression.
Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
proxmox-nftables/src/expression.rs | 2 ++
proxmox-ve-config/src/firewall/types/rule_match.rs | 12 ++++++++++++
2 files changed, 14 insertions(+)
diff --git a/proxmox-nftables/src/expression.rs b/proxmox-nftables/src/expression.rs
index 20559e8..18b92d4 100644
--- a/proxmox-nftables/src/expression.rs
+++ b/proxmox-nftables/src/expression.rs
@@ -185,6 +185,7 @@ impl From<&IcmpType> for Expression {
match value {
IcmpType::Numeric(id) => Expression::from(*id),
IcmpType::Named(name) => Expression::from(*name),
+ IcmpType::Any => Expression::Range(Box::new((u8::MIN.into(), u8::MAX.into()))),
}
}
}
@@ -205,6 +206,7 @@ impl From<&Icmpv6Type> for Expression {
match value {
Icmpv6Type::Numeric(id) => Expression::from(*id),
Icmpv6Type::Named(name) => Expression::from(*name),
+ Icmpv6Type::Any => Expression::Range(Box::new((u8::MIN.into(), u8::MAX.into()))),
}
}
}
diff --git a/proxmox-ve-config/src/firewall/types/rule_match.rs b/proxmox-ve-config/src/firewall/types/rule_match.rs
index 948b426..94d8624 100644
--- a/proxmox-ve-config/src/firewall/types/rule_match.rs
+++ b/proxmox-ve-config/src/firewall/types/rule_match.rs
@@ -511,6 +511,7 @@ impl FromStr for Icmp {
pub enum IcmpType {
Numeric(u8),
Named(&'static str),
+ Any,
}
#[sortable]
@@ -536,6 +537,10 @@ impl std::str::FromStr for IcmpType {
type Err = Error;
fn from_str(s: &str) -> Result<Self, Error> {
+ if s.eq_ignore_ascii_case("any") {
+ return Ok(Self::Any);
+ }
+
if let Ok(ty) = s.trim().parse::<u8>() {
return Ok(Self::Numeric(ty));
}
@@ -553,6 +558,7 @@ impl fmt::Display for IcmpType {
match self {
IcmpType::Numeric(ty) => write!(f, "{ty}"),
IcmpType::Named(ty) => write!(f, "{ty}"),
+ IcmpType::Any => write!(f, "any"),
}
}
}
@@ -664,6 +670,7 @@ impl FromStr for Icmpv6 {
pub enum Icmpv6Type {
Numeric(u8),
Named(&'static str),
+ Any,
}
#[sortable]
@@ -693,6 +700,10 @@ impl std::str::FromStr for Icmpv6Type {
type Err = Error;
fn from_str(s: &str) -> Result<Self, Error> {
+ if s.eq_ignore_ascii_case("any") {
+ return Ok(Self::Any);
+ }
+
if let Ok(ty) = s.trim().parse::<u8>() {
return Ok(Self::Numeric(ty));
}
@@ -710,6 +721,7 @@ impl fmt::Display for Icmpv6Type {
match self {
Icmpv6Type::Numeric(ty) => write!(f, "{ty}"),
Icmpv6Type::Named(ty) => write!(f, "{ty}"),
+ Icmpv6Type::Any => write!(f, "any"),
}
}
}
--
2.39.2
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 2+ messages in thread
* [pve-devel] applied: [PATCH proxmox-firewall] config: nftables: add support for icmp-type any
2024-04-25 17:16 [pve-devel] [PATCH proxmox-firewall] config: nftables: add support for icmp-type any Stefan Hanreich
@ 2024-04-25 17:32 ` Thomas Lamprecht
0 siblings, 0 replies; 2+ messages in thread
From: Thomas Lamprecht @ 2024-04-25 17:32 UTC (permalink / raw)
To: Proxmox VE development discussion, Stefan Hanreich
Am 25/04/2024 um 19:16 schrieb Stefan Hanreich:
> We support any as wildcard for matching all icmp types. Implement
> parsing logic for parsing the any value and support converting the any
> value into an nftables expression.
>
> Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
> ---
> proxmox-nftables/src/expression.rs | 2 ++
> proxmox-ve-config/src/firewall/types/rule_match.rs | 12 ++++++++++++
> 2 files changed, 14 insertions(+)
>
>
applied, thanks!
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-04-25 17:32 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-04-25 17:16 [pve-devel] [PATCH proxmox-firewall] config: nftables: add support for icmp-type any Stefan Hanreich
2024-04-25 17:32 ` [pve-devel] applied: " Thomas Lamprecht
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox