Re: [RFC proxmox 14/22] firewall-api-types: add firewall address types

[Wolfgang Bumiller <w.bumiller@proxmox.com>]

On Mon, Feb 16, 2026 at 11:43:52AM +0100, Dietmar Maurer wrote:
> This adds new types for representing firewall address matches:
> 
> - FirewallAddressMatch: enum for IP lists, ipset references, or alias
>   references
> - FirewallAddressList: validated list of address entries with consistent
>   address family
> - FirewallAddressEntry: enum for CIDR or IP range entries
> 
> The implementation includes:
> - Proper encapsulation with constructor and accessor methods
> - Address family validation in FirewallAddressList::new()
> - FromStr implementations for parsing address specifications
> - Integration with existing FirewallIpsetReference and
>   FirewallAliasReference types
> 
> Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
> ---
>  proxmox-firewall-api-types/Cargo.toml     |   1 +
>  proxmox-firewall-api-types/src/address.rs | 225 ++++++++++++++++++++++
>  proxmox-firewall-api-types/src/lib.rs     |   3 +
>  3 files changed, 229 insertions(+)
>  create mode 100644 proxmox-firewall-api-types/src/address.rs
> 
> diff --git a/proxmox-firewall-api-types/Cargo.toml b/proxmox-firewall-api-types/Cargo.toml
> index 97b477b8..8b77b522 100644
> --- a/proxmox-firewall-api-types/Cargo.toml
> +++ b/proxmox-firewall-api-types/Cargo.toml
> @@ -22,3 +22,4 @@ serde_plain = { workspace = true }
>  proxmox-schema = { workspace = true, features = ["api-macro"] }
>  proxmox-serde = { workspace = true, features = ["perl"] }
>  proxmox-fixed-string = { workspace = true, optional = true }
> +proxmox-network-types = { workspace = true, features = [ "api-types" ] }
> diff --git a/proxmox-firewall-api-types/src/address.rs b/proxmox-firewall-api-types/src/address.rs
> new file mode 100644
> index 00000000..46166352
> --- /dev/null
> +++ b/proxmox-firewall-api-types/src/address.rs
> @@ -0,0 +1,225 @@
> +use std::fmt;
> +use std::str::FromStr;
> +
> +use super::{FirewallAliasReference, FirewallIpsetReference};
> +
> +use anyhow::{bail, Error};
> +use proxmox_network_types::ip_address::{Cidr, Family, IpRange};
> +use proxmox_schema::{ApiStringFormat, ApiType, Schema, StringSchema};
> +
> +/// A match for source or destination address.
> +#[derive(Clone, Debug, PartialEq)]
> +pub enum FirewallAddressMatch {
> +    /// IP address list match.
> +    Ip(FirewallAddressList),
> +    /// IP set match.
> +    Ipset(FirewallIpsetReference),
> +    /// Alias match.
> +    Alias(FirewallAliasReference),
> +}
> +
> +impl ApiType for FirewallAddressMatch {
> +    const API_SCHEMA: Schema = StringSchema::new(
> +        r#"Restrict source or destination packet address.
> +    This can refer to a single IP address,
> +    an IP set ('+ipsetname') or an IP alias definition. You can also specify
> +    an address range like '20.34.101.207-201.3.9.99', or a list of IP
> +    addresses and networks (entries are separated by comma). Please do not
> +    mix IPv4 and IPv6 addresses inside such lists."#,

The string here contains all the white space, better use a non-raw
string with backslashes to allow for indentation.

> +    )
> +    .format(&ApiStringFormat::VerifyFn(verify_firewall_address_match))
> +    .max_length(512)
> +    .schema();
> +}
> +