Currently when setting ICMP types on the old firewall (iptables) then switching to the new one (nftables) a few types will fail because they have been renamed in nftables or do not exist in nftables. This affects both icmp and icmpv6 where we now map options that do not exist in nftables to their respective type/code combinations. This allows us to have exactly the same behavior in nftables as we have in iptables.
Changelog: v1, thanks Stefan and Thomas: * no hard error when mapping not possible * map all the types by falling back to custom type/code * also map icmp types in addition to icmpv6 ve-rs: Gabriel Goller (1): fix: firewall: introduce iptables to nftables mapping for icmpv6-types Wolfgang Bumiller (1): fix: firewall: introduce iptables to nftables mapping for icmp-types proxmox-ve-config/src/firewall/cluster.rs | 9 +- proxmox-ve-config/src/firewall/types/rule.rs | 9 +- .../src/firewall/types/rule_match.rs | 139 +++++++++++++++--- 3 files changed, 129 insertions(+), 28 deletions(-) proxmox-firewall: Gabriel Goller (1): tests: add icmpv6 type mapping test proxmox-firewall/tests/input/host.fw | 1 + .../integration_tests__firewall.snap | 63 +++++++++++++++++++ 2 files changed, 64 insertions(+) Summary over all repositories: 5 files changed, 193 insertions(+), 28 deletions(-) -- Generated by git-murpp 0.8.0 _______________________________________________ pve-devel mailing list [email protected] https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
