test/simulator: add very basic ICMP type functionallity

For now without integer to full-name, and vice versa, mapping of
ICMP types.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

diff --git a/src/PVE/FirewallSimulator.pm b/src/PVE/FirewallSimulator.pm
index 4f46b742b8980ca0f73714856c7643126743f4b5..140c46ebf5d9b9ca07dbabcd399ad8aa0ad79737 100644 (file)
--- a/src/PVE/FirewallSimulator.pm
+++ b/src/PVE/FirewallSimulator.pm
@@ -29,9 +29,7 @@ my $NUMBER_RE = qr/0x[0-9a-fA-F]+|\d+/;
 
 sub debug {
     my $new_value = shift;
 
 sub debug {
     my $new_value = shift;

-

     $debug = $new_value if defined($new_value);
     $debug = $new_value if defined($new_value);

-

     return $debug;
 }
 
     return $debug;
 }
 


@@ -140,6 +138,13 @@ sub rule_match {
            return undef if $atype ne $pkg->{dsttype};
        }
 
            return undef if $atype ne $pkg->{dsttype};
        }
 

+       if ($rule =~ s/^-m icmp(v6)? --icmp-type (\S+)\s*//) {
+           my $icmpv6 = !!$1;
+           my $icmptype = $2;
+           die "missing destination address type (dsttype)\n" if !defined($pkg->{dport});
+           return undef if $icmptype ne $pkg->{dport};
+       }
+

        if ($rule =~ s/^-i (\S+)\s*//) {
            my $devre = $1;
            die "missing interface (iface_in)\n" if !$pkg->{iface_in};
        if ($rule =~ s/^-i (\S+)\s*//) {
            my $devre = $1;
            die "missing interface (iface_in)\n" if !$pkg->{iface_in};

diff --git a/test/test-basic1/100.fw b/test/test-basic1/100.fw
index c9d675e9e2ff2528870215df04ebe63474e1c95c..9dbe2f37fbfa9cd43137e35563f3126c0cb8d260 100644 (file)
--- a/test/test-basic1/100.fw
+++ b/test/test-basic1/100.fw
@@ -5,4 +5,6 @@ enable: 1
 [RULES]
 
 IN ACCEPT -p tcp -dport 443
 [RULES]
 
 IN ACCEPT -p tcp -dport 443

+IN ACCEPT -p icmp -dport 0
+IN ACCEPT -p icmp -dport host-unreachable

 OUT REJECT -p tcp -dport 81
 OUT REJECT -p tcp -dport 81

diff --git a/test/test-basic1/tests b/test/test-basic1/tests
index d575bbe806c322263d597237c5cb51eae0391f5d..a993e5d46ba12bcd6c32cac9f463ca89d9bdfe0c 100644 (file)
--- a/test/test-basic1/tests
+++ b/test/test-basic1/tests
@@ -21,6 +21,10 @@
 { from => 'vm110', to => 'vm100', dport => 22, action => 'DROP' }
 { from => 'vm110', to => 'vm100', dport => 443, action => 'ACCEPT' }
 
 { from => 'vm110', to => 'vm100', dport => 22, action => 'DROP' }
 { from => 'vm110', to => 'vm100', dport => 443, action => 'ACCEPT' }
 

+{ from => 'vm110', to => 'vm100', dport => 0, proto => 'icmp', action => 'ACCEPT' }
+{ from => 'vm110', to => 'vm100', dport => 'host-unreachable', proto => 'icmp', action => 'ACCEPT' }
+{ from => 'vm110', to => 'vm100', dport => 255, proto => 'icmpv6', action => 'DROP' }
+

 { from => 'outside', to => 'ct200', dport => 22, action => 'ACCEPT' }
 { from => 'outside', to => 'ct200', dport => 23, action => 'DROP' }
 { from => 'outside', to => 'vm100', dport => 22, action => 'DROP' }
 { from => 'outside', to => 'ct200', dport => 22, action => 'ACCEPT' }
 { from => 'outside', to => 'ct200', dport => 23, action => 'DROP' }
 { from => 'outside', to => 'vm100', dport => 22, action => 'DROP' }