From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id BE0DC1FF13F for ; Thu, 12 Mar 2026 14:25:31 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 1749C15AD9; Thu, 12 Mar 2026 14:25:26 +0100 (CET) Date: Thu, 12 Mar 2026 14:24:51 +0100 From: Wolfgang Bumiller To: Dietmar Maurer Subject: Re: [RFC proxmox 14/22] firewall-api-types: add firewall address types Message-ID: References: <20260216104401.3959270-1-dietmar@proxmox.com> <20260216104401.3959270-15-dietmar@proxmox.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260216104401.3959270-15-dietmar@proxmox.com> X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1773321856123 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.084 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_MSPIKE_H2 0.001 Average reputation (+2) SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: QRYYEAOY3LT7UYF5L2WEW3H7375XODNN X-Message-ID-Hash: QRYYEAOY3LT7UYF5L2WEW3H7375XODNN X-MailFrom: w.bumiller@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: pve-devel@lists.proxmox.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Mon, Feb 16, 2026 at 11:43:52AM +0100, Dietmar Maurer wrote: > This adds new types for representing firewall address matches: > > - FirewallAddressMatch: enum for IP lists, ipset references, or alias > references > - FirewallAddressList: validated list of address entries with consistent > address family > - FirewallAddressEntry: enum for CIDR or IP range entries > > The implementation includes: > - Proper encapsulation with constructor and accessor methods > - Address family validation in FirewallAddressList::new() > - FromStr implementations for parsing address specifications > - Integration with existing FirewallIpsetReference and > FirewallAliasReference types > > Signed-off-by: Dietmar Maurer > --- > proxmox-firewall-api-types/Cargo.toml | 1 + > proxmox-firewall-api-types/src/address.rs | 225 ++++++++++++++++++++++ > proxmox-firewall-api-types/src/lib.rs | 3 + > 3 files changed, 229 insertions(+) > create mode 100644 proxmox-firewall-api-types/src/address.rs > > diff --git a/proxmox-firewall-api-types/Cargo.toml b/proxmox-firewall-api-types/Cargo.toml > index 97b477b8..8b77b522 100644 > --- a/proxmox-firewall-api-types/Cargo.toml > +++ b/proxmox-firewall-api-types/Cargo.toml > @@ -22,3 +22,4 @@ serde_plain = { workspace = true } > proxmox-schema = { workspace = true, features = ["api-macro"] } > proxmox-serde = { workspace = true, features = ["perl"] } > proxmox-fixed-string = { workspace = true, optional = true } > +proxmox-network-types = { workspace = true, features = [ "api-types" ] } > diff --git a/proxmox-firewall-api-types/src/address.rs b/proxmox-firewall-api-types/src/address.rs > new file mode 100644 > index 00000000..46166352 > --- /dev/null > +++ b/proxmox-firewall-api-types/src/address.rs > @@ -0,0 +1,225 @@ > +use std::fmt; > +use std::str::FromStr; > + > +use super::{FirewallAliasReference, FirewallIpsetReference}; > + > +use anyhow::{bail, Error}; > +use proxmox_network_types::ip_address::{Cidr, Family, IpRange}; > +use proxmox_schema::{ApiStringFormat, ApiType, Schema, StringSchema}; > + > +/// A match for source or destination address. > +#[derive(Clone, Debug, PartialEq)] > +pub enum FirewallAddressMatch { > + /// IP address list match. > + Ip(FirewallAddressList), > + /// IP set match. > + Ipset(FirewallIpsetReference), > + /// Alias match. > + Alias(FirewallAliasReference), > +} > + > +impl ApiType for FirewallAddressMatch { > + const API_SCHEMA: Schema = StringSchema::new( > + r#"Restrict source or destination packet address. > + This can refer to a single IP address, > + an IP set ('+ipsetname') or an IP alias definition. You can also specify > + an address range like '20.34.101.207-201.3.9.99', or a list of IP > + addresses and networks (entries are separated by comma). Please do not > + mix IPv4 and IPv6 addresses inside such lists."#, The string here contains all the white space, better use a non-raw string with backslashes to allow for indentation. > + ) > + .format(&ApiStringFormat::VerifyFn(verify_firewall_address_match)) > + .max_length(512) > + .schema(); > +} > +