tested this series and found another pre-existing issue with rule generation, which I sent a patch for [1].
Together with the patch series I sent applied, this patch series solves the issues on my test instance. Code LGTM as well - so consider this: Tested-by: Stefan Hanreich <[email protected]> Reviewed-by: Stefan Hanreich <[email protected]> [1] https://lore.proxmox.com/pve-devel/[email protected]/T/#t On 10/6/25 12:19 PM, Gabriel Goller wrote: > Currently when setting ICMP types on the old firewall (iptables) then > switching to the new one (nftables) a few types will fail because they have > been renamed in nftables or do not exist in nftables. This affects both icmp > and icmpv6 where we now map options that do not exist in nftables to their > respective type/code combinations. This allows us to have exactly the same > behavior in nftables as we have in iptables. > > Changelog: > v1, thanks Stefan and Thomas: > * no hard error when mapping not possible > * map all the types by falling back to custom type/code > * also map icmp types in addition to icmpv6 > > ve-rs: > > Gabriel Goller (1): > fix: firewall: introduce iptables to nftables mapping for icmpv6-types > > Wolfgang Bumiller (1): > fix: firewall: introduce iptables to nftables mapping for icmp-types > > proxmox-ve-config/src/firewall/cluster.rs | 9 +- > proxmox-ve-config/src/firewall/types/rule.rs | 9 +- > .../src/firewall/types/rule_match.rs | 139 +++++++++++++++--- > 3 files changed, 129 insertions(+), 28 deletions(-) > > > proxmox-firewall: > > Gabriel Goller (1): > tests: add icmpv6 type mapping test > > proxmox-firewall/tests/input/host.fw | 1 + > .../integration_tests__firewall.snap | 63 +++++++++++++++++++ > 2 files changed, 64 insertions(+) > > > Summary over all repositories: > 5 files changed, 193 insertions(+), 28 deletions(-) > _______________________________________________ pve-devel mailing list [email protected] https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
