fix #4175: ignore non-filter ebtables tables

[pve-firewall.git] / src / PVE / FirewallSimulator.pm

diff --git a/src/PVE/FirewallSimulator.pm b/src/PVE/FirewallSimulator.pm
index 4f46b742b8980ca0f73714856c7643126743f4b5..140c46ebf5d9b9ca07dbabcd399ad8aa0ad79737 100644 (file)
--- a/src/PVE/FirewallSimulator.pm
+++ b/src/PVE/FirewallSimulator.pm
@@ -29,9 +29,7 @@ my $NUMBER_RE = qr/0x[0-9a-fA-F]+|\d+/;
 
 sub debug {
     my $new_value = shift;
-
     $debug = $new_value if defined($new_value);
-
     return $debug;
 }
 
@@ -140,6 +138,13 @@ sub rule_match {
            return undef if $atype ne $pkg->{dsttype};
        }
 
+       if ($rule =~ s/^-m icmp(v6)? --icmp-type (\S+)\s*//) {
+           my $icmpv6 = !!$1;
+           my $icmptype = $2;
+           die "missing destination address type (dsttype)\n" if !defined($pkg->{dport});
+           return undef if $icmptype ne $pkg->{dport};
+       }
+
        if ($rule =~ s/^-i (\S+)\s*//) {
            my $devre = $1;
            die "missing interface (iface_in)\n" if !$pkg->{iface_in};