When the firewall was enabled for a guest, but disabled for all
interfaces of a guest, the firewall tried to add an empty list to the
guest map, which is an invalid nftables statement.
Signed-off-by: Stefan Hanreich <s.hanre...@proxmox.com>
---
proxmox-firewall/src/firewall.rs | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/proxmox-firewall/src/firewall.rs b/proxmox-firewall/src/firewall.rs
index e1c9351..086b96c 100644
--- a/proxmox-firewall/src/firewall.rs
+++ b/proxmox-firewall/src/firewall.rs
@@ -955,7 +955,7 @@ impl Firewall {
let network_devices = config.network_config().network_devices();
if !network_devices.is_empty() {
- let map_elements = network_devices
+ let map_elements: Vec<(Expression, MapValue)> = network_devices
.iter()
.filter(|(_, device)| device.has_firewall())
.map(|(index, _)| {
@@ -965,12 +965,15 @@ impl Firewall {
target: chain.name().to_string(),
}),
)
- });
+ })
+ .collect();
- commands.push(Add::element(AddElement::map_from_expressions(
- Self::guest_vmap(direction),
- map_elements,
- )));
+ if !map_elements.is_empty() {
+ commands.push(Add::element(AddElement::map_from_expressions(
+ Self::guest_vmap(direction),
+ map_elements,
+ )));
+ }
}
self.create_log_rule(
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
