Merge pull request #1184 from sarthurdev/firewall_icmp

firewall: T4130: T4186: ICMP/v6 updates, ipv6 state policy check fix

6 files changed, 213 insertions, 288 deletions

diff --git a/interface-definitions/firewall.xml.in b/interface-definitions/firewall.xml.in
index 987ccaca6..f38bcfd9c 100644
--- a/interface-definitions/firewall.xml.in
+++ b/interface-definitions/firewall.xml.in
@@ -329,182 +329,31 @@
                   <help>ICMPv6 type and code information</help>
                 </properties>
                 <children>
-                  <leafNode name="type">
+                  <leafNode name="code">
                     <properties>
-                      <help>ICMP type-name</help>
-                      <completionHelp>
-                        <list>any echo-reply pong destination-unreachable network-unreachable host-unreachable protocol-unreachable port-unreachable fragmentation-needed source-route-failed network-unknown host-unknown network-prohibited host-prohibited TOS-network-unreachable TOS-host-unreachable communication-prohibited host-precedence-violation precedence-cutoff source-quench redirect network-redirect host-redirect TOS-network-redirect TOS host-redirect echo-request ping router-advertisement router-solicitation time-exceeded ttl-exceeded ttl-zero-during-transit ttl-zero-during-reassembly parameter-problem ip-header-bad required-option-missing timestamp-request timestamp-reply address-mask-request address-mask-reply packet-too-big</list>
-                      </completionHelp>
-                      <valueHelp>
-                        <format>any</format>
-                        <description>Any ICMP type/code</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>echo-reply</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>pong</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>destination-unreachable</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>network-unreachable</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
+                      <help>ICMPv6 code (0-255)</help>
                       <valueHelp>
-                        <format>host-unreachable</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>protocol-unreachable</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>port-unreachable</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>fragmentation-needed</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>source-route-failed</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>network-unknown</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>host-unknown</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>network-prohibited</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>host-prohibited</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>TOS-network-unreachable</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>TOS-host-unreachable</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>communication-prohibited</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>host-precedence-violation</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>precedence-cutoff</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>source-quench</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>redirect</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>network-redirect</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>host-redirect</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>TOS-network-redirect</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>TOS host-redirect</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>echo-request</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>ping</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>router-advertisement</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>router-solicitation</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>time-exceeded</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>ttl-exceeded</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>ttl-zero-during-transit</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>ttl-zero-during-reassembly</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>parameter-problem</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>ip-header-bad</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>required-option-missing</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>timestamp-request</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>timestamp-reply</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>address-mask-request</format>
-                        <description>ICMP type/code name</description>
-                      </valueHelp>
-                      <valueHelp>
-                        <format>address-mask-reply</format>
-                        <description>ICMP type/code name</description>
+                        <format>u32:0-255</format>
+                        <description>ICMPv6 code (0-255)</description>
                       </valueHelp>
+                      <constraint>
+                        <validator name="numeric" argument="--range 0-255"/>
+                      </constraint>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="type">
+                    <properties>
+                      <help>ICMPv6 type (0-255)</help>
                       <valueHelp>
-                        <format>packet-too-big</format>
-                        <description>ICMP type/code name</description>
+                        <format>u32:0-255</format>
+                        <description>ICMPv6 type (0-255)</description>
                       </valueHelp>
                       <constraint>
-                        <regex>^(any|echo-reply|pong|destination-unreachable|network-unreachable|host-unreachable|protocol-unreachable|port-unreachable|fragmentation-needed|source-route-failed|network-unknown|host-unknown|network-prohibited|host-prohibited|TOS-network-unreachable|TOS-host-unreachable|communication-prohibited|host-precedence-violation|precedence-cutoff|source-quench|redirect|network-redirect|host-redirect|TOS-network-redirect|TOS host-redirect|echo-request|ping|router-advertisement|router-solicitation|time-exceeded|ttl-exceeded|ttl-zero-during-transit|ttl-zero-during-reassembly|parameter-problem|ip-header-bad|required-option-missing|timestamp-request|timestamp-reply|address-mask-request|address-mask-reply|packet-too-big)$</regex>
                         <validator name="numeric" argument="--range 0-255"/>
                       </constraint>
                     </properties>
                   </leafNode>
+                  #include <include/firewall/icmpv6-type-name.xml.i>
                 </children>
               </node>
             </children>
diff --git a/interface-definitions/include/firewall/icmp-type-name.xml.i b/interface-definitions/include/firewall/icmp-type-name.xml.i
index b45fb619b..f57def3e1 100644
--- a/interface-definitions/include/firewall/icmp-type-name.xml.i
+++ b/interface-definitions/include/firewall/icmp-type-name.xml.i
@@ -3,170 +3,70 @@
   <properties>
     <help>ICMP type-name</help>
     <completionHelp>
-      <list>any echo-reply pong destination-unreachable network-unreachable host-unreachable protocol-unreachable port-unreachable fragmentation-needed source-route-failed network-unknown host-unknown network-prohibited host-prohibited TOS-network-unreachable TOS-host-unreachable communication-prohibited host-precedence-violation precedence-cutoff source-quench redirect network-redirect host-redirect TOS-network-redirect TOS host-redirect echo-request ping router-advertisement router-solicitation time-exceeded ttl-exceeded ttl-zero-during-transit ttl-zero-during-reassembly parameter-problem ip-header-bad required-option-missing timestamp-request timestamp-reply address-mask-request address-mask-reply</list>
+      <list>echo-reply destination-unreachable source-quench redirect echo-request router-advertisement router-solicitation time-exceeded parameter-problem timestamp-request timestamp-reply info-request info-reply address-mask-request address-mask-reply</list>
     </completionHelp>
     <valueHelp>
-      <format>any</format>
-      <description>Any ICMP type/code</description>
-    </valueHelp>
-    <valueHelp>
       <format>echo-reply</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>pong</format>
-      <description>ICMP type/code name</description>
+      <description>ICMP type 0: echo-reply</description>
     </valueHelp>
     <valueHelp>
       <format>destination-unreachable</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>network-unreachable</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>host-unreachable</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>protocol-unreachable</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>port-unreachable</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>fragmentation-needed</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>source-route-failed</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>network-unknown</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>host-unknown</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>network-prohibited</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>host-prohibited</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>TOS-network-unreachable</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>TOS-host-unreachable</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>communication-prohibited</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>host-precedence-violation</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>precedence-cutoff</format>
-      <description>ICMP type/code name</description>
+      <description>ICMP type 3: destination-unreachable</description>
     </valueHelp>
     <valueHelp>
       <format>source-quench</format>
-      <description>ICMP type/code name</description>
+      <description>ICMP type 4: source-quench</description>
     </valueHelp>
     <valueHelp>
       <format>redirect</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>network-redirect</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>host-redirect</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>TOS-network-redirect</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>TOS host-redirect</format>
-      <description>ICMP type/code name</description>
+      <description>ICMP type 5: redirect</description>
     </valueHelp>
     <valueHelp>
       <format>echo-request</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>ping</format>
-      <description>ICMP type/code name</description>
+      <description>ICMP type 8: echo-request</description>
     </valueHelp>
     <valueHelp>
       <format>router-advertisement</format>
-      <description>ICMP type/code name</description>
+      <description>ICMP type 9: router-advertisement</description>
     </valueHelp>
     <valueHelp>
       <format>router-solicitation</format>
-      <description>ICMP type/code name</description>
+      <description>ICMP type 10: router-solicitation</description>
     </valueHelp>
     <valueHelp>
       <format>time-exceeded</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>ttl-exceeded</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>ttl-zero-during-transit</format>
-      <description>ICMP type/code name</description>
-    </valueHelp>
-    <valueHelp>
-      <format>ttl-zero-during-reassembly</format>
-      <description>ICMP type/code name</description>
+      <description>ICMP type 11: time-exceeded</description>
     </valueHelp>
     <valueHelp>
       <format>parameter-problem</format>
-      <description>ICMP type/code name</description>
+      <description>ICMP type 12: parameter-problem</description>
     </valueHelp>
     <valueHelp>
-      <format>ip-header-bad</format>
-      <description>ICMP type/code name</description>
+      <format>timestamp-request</format>
+      <description>ICMP type 13: timestamp-request</description>
     </valueHelp>
     <valueHelp>
-      <format>required-option-missing</format>
-      <description>ICMP type/code name</description>
+      <format>timestamp-reply</format>
+      <description>ICMP type 14: timestamp-reply</description>
     </valueHelp>
     <valueHelp>
-      <format>timestamp-request</format>
-      <description>ICMP type/code name</description>
+      <format>info-request</format>
+      <description>ICMP type 15: info-request</description>
     </valueHelp>
     <valueHelp>
-      <format>timestamp-reply</format>
-      <description>ICMP type/code name</description>
+      <format>info-reply</format>
+      <description>ICMP type 16: info-reply</description>
     </valueHelp>
     <valueHelp>
       <format>address-mask-request</format>
-      <description>ICMP type/code name</description>
+      <description>ICMP type 17: address-mask-request</description>
     </valueHelp>
     <valueHelp>
       <format>address-mask-reply</format>
-      <description>ICMP type/code name</description>
+      <description>ICMP type 18: address-mask-reply</description>
     </valueHelp>
     <constraint>
-      <regex>^(any|echo-reply|pong|destination-unreachable|network-unreachable|host-unreachable|protocol-unreachable|port-unreachable|fragmentation-needed|source-route-failed|network-unknown|host-unknown|network-prohibited|host-prohibited|TOS-network-unreachable|TOS-host-unreachable|communication-prohibited|host-precedence-violation|precedence-cutoff|source-quench|redirect|network-redirect|host-redirect|TOS-network-redirect|TOS host-redirect|echo-request|ping|router-advertisement|router-solicitation|time-exceeded|ttl-exceeded|ttl-zero-during-transit|ttl-zero-during-reassembly|parameter-problem|ip-header-bad|required-option-missing|timestamp-request|timestamp-reply|address-mask-request|address-mask-reply)$</regex>
+      <regex>^(echo-reply|destination-unreachable|source-quench|redirect|echo-request|router-advertisement|router-solicitation|time-exceeded|parameter-problem|timestamp-request|timestamp-reply|info-request|info-reply|address-mask-request|address-mask-reply)$</regex>
     </constraint>
   </properties>
 </leafNode>
diff --git a/interface-definitions/include/firewall/icmpv6-type-name.xml.i b/interface-definitions/include/firewall/icmpv6-type-name.xml.i
new file mode 100644
index 000000000..b13cf02c4
--- /dev/null
+++ b/interface-definitions/include/firewall/icmpv6-type-name.xml.i
@@ -0,0 +1,73 @@
+<!-- include start from firewall/icmpv6-type-name.xml.i -->
+<leafNode name="type-name">
+  <properties>
+    <help>ICMPv6 type-name</help>
+    <completionHelp>
+      <list>destination-unreachable packet-too-big time-exceeded echo-request echo-reply mld-listener-query mld-listener-report mld-listener-reduction nd-router-solicit nd-router-advert nd-neighbor-solicit nd-neighbor-advert nd-redirect parameter-problem router-renumbering</list>
+    </completionHelp>
+    <valueHelp>
+      <format>destination-unreachable</format>
+      <description>ICMPv6 type 1: destination-unreachable</description>
+    </valueHelp>
+    <valueHelp>
+      <format>packet-too-big</format>
+      <description>ICMPv6 type 2: packet-too-big</description>
+    </valueHelp>
+    <valueHelp>
+      <format>time-exceeded</format>
+      <description>ICMPv6 type 3: time-exceeded</description>
+    </valueHelp>
+    <valueHelp>
+      <format>echo-request</format>
+      <description>ICMPv6 type 128: echo-request</description>
+    </valueHelp>
+    <valueHelp>
+      <format>echo-reply</format>
+      <description>ICMPv6 type 129: echo-reply</description>
+    </valueHelp>
+    <valueHelp>
+      <format>mld-listener-query</format>
+      <description>ICMPv6 type 130: mld-listener-query</description>
+    </valueHelp>
+    <valueHelp>
+      <format>mld-listener-report</format>
+      <description>ICMPv6 type 131: mld-listener-report</description>
+    </valueHelp>
+    <valueHelp>
+      <format>mld-listener-reduction</format>
+      <description>ICMPv6 type 132: mld-listener-reduction</description>
+    </valueHelp>
+    <valueHelp>
+      <format>nd-router-solicit</format>
+      <description>ICMPv6 type 133: nd-router-solicit</description>
+    </valueHelp>
+    <valueHelp>
+      <format>nd-router-advert</format>
+      <description>ICMPv6 type 134: nd-router-advert</description>
+    </valueHelp>
+    <valueHelp>
+      <format>nd-neighbor-solicit</format>
+      <description>ICMPv6 type 135: nd-neighbor-solicit</description>
+    </valueHelp>
+    <valueHelp>
+      <format>nd-neighbor-advert</format>
+      <description>ICMPv6 type 136: nd-neighbor-advert</description>
+    </valueHelp>
+    <valueHelp>
+      <format>nd-redirect</format>
+      <description>ICMPv6 type 137: nd-redirect</description>
+    </valueHelp>
+    <valueHelp>
+      <format>parameter-problem</format>
+      <description>ICMPv6 type 4: parameter-problem</description>
+    </valueHelp>
+    <valueHelp>
+      <format>router-renumbering</format>
+      <description>ICMPv6 type 138: router-renumbering</description>
+    </valueHelp>
+    <constraint>
+      <regex>^(destination-unreachable|packet-too-big|time-exceeded|echo-request|echo-reply|mld-listener-query|mld-listener-report|mld-listener-reduction|nd-router-solicit|nd-router-advert|nd-neighbor-solicit|nd-neighbor-advert|nd-redirect|parameter-problem|router-renumbering)$</regex>
+    </constraint>
+  </properties>
+</leafNode>
+<!-- include end -->
diff --git a/src/conf_mode/firewall-interface.py b/src/conf_mode/firewall-interface.py
index b0df9dff4..a7442ecbd 100755
--- a/src/conf_mode/firewall-interface.py
+++ b/src/conf_mode/firewall-interface.py
@@ -150,7 +150,7 @@ def apply(if_firewall):
                 rule_action = 'insert'
                 rule_prefix = ''
 
-                handle = state_policy_handle('ip filter', chain)
+                handle = state_policy_handle('ip6 filter', ipv6_chain)
                 if handle:
                     rule_action = 'add'
                     rule_prefix = f'position {handle}'
diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py
index 82223d60b..358b938e3 100755
--- a/src/conf_mode/firewall.py
+++ b/src/conf_mode/firewall.py
@@ -184,6 +184,12 @@ def verify_rule(firewall, rule_conf, ipv6):
             if duplicates:
                 raise ConfigError(f'Cannot match a tcp flag as set and not set')
 
+    if 'protocol' in rule_conf:
+        if rule_conf['protocol'] == 'icmp' and ipv6:
+            raise ConfigError(f'Cannot match IPv4 ICMP protocol on IPv6, use ipv6-icmp')
+        if rule_conf['protocol'] == 'ipv6-icmp' and not ipv6:
+            raise ConfigError(f'Cannot match IPv6 ICMP protocol on IPv4, use icmp')
+
     for side in ['destination', 'source']:
         if side in rule_conf:
             side_conf = rule_conf[side]
diff --git a/src/migration-scripts/firewall/6-to-7 b/src/migration-scripts/firewall/6-to-7
index bc0b19325..cc3a9b559 100755
--- a/src/migration-scripts/firewall/6-to-7
+++ b/src/migration-scripts/firewall/6-to-7
@@ -17,8 +17,11 @@
 # T2199: Remove unavailable nodes due to XML/Python implementation using nftables
 #        monthdays: nftables does not have a monthdays equivalent
 #        utc: nftables userspace uses localtime and calculates the UTC offset automatically
+#        icmp/v6: migrate previously available `type-name` to valid type/code
 # T4178: Update tcp flags to use multi value node
 
+import re
+
 from sys import argv
 from sys import exit
 
@@ -41,12 +44,67 @@ if not config.exists(base):
     # Nothing to do
     exit(0)
 
+icmp_remove = ['any']
+icmp_translations = {
+    'ping': 'echo-request',
+    'pong': 'echo-reply',
+    'ttl-exceeded': 'time-exceeded',
+    # Network Unreachable
+    'network-unreachable': [3, 0],
+    'host-unreachable': [3, 1],
+    'protocol-unreachable': [3, 2],
+    'port-unreachable': [3, 3],
+    'fragmentation-needed': [3, 4],
+    'source-route-failed': [3, 5],
+    'network-unknown': [3, 6],
+    'host-unknown': [3, 7],
+    'network-prohibited': [3, 9],
+    'host-prohibited': [3, 10],
+    'TOS-network-unreachable': [3, 11],
+    'TOS-host-unreachable': [3, 12],
+    'communication-prohibited': [3, 13],
+    'host-precedence-violation': [3, 14],
+    'precedence-cutoff': [3, 15],
+    # Redirect
+    'network-redirect': [5, 0],
+    'host-redirect': [5, 1],
+    'TOS-network-redirect': [5, 2],
+    'TOS host-redirect': [5, 3],
+    #  Time Exceeded
+    'ttl-zero-during-transit': [11, 0],
+    'ttl-zero-during-reassembly': [11, 1],
+    # Parameter Problem
+    'ip-header-bad': [12, 0],
+    'required-option-missing': [12, 1]
+}
+
+icmpv6_remove = []
+icmpv6_translations = {
+    'ping': 'echo-request',
+    'pong': 'echo-reply',
+    # Destination Unreachable
+    'no-route': [1, 0],
+    'communication-prohibited': [1, 1],
+    'address-unreachble': [1, 3],
+    'port-unreachable': [1, 4],
+    # Redirect
+    'redirect': 'nd-redirect',
+    #  Time Exceeded
+    'ttl-zero-during-transit': [3, 0],
+    'ttl-zero-during-reassembly': [3, 1],
+    # Parameter Problem
+    'bad-header': [4, 0],
+    'unknown-header-type': [4, 1],
+    'unknown-option': [4, 2]
+}
+
 if config.exists(base + ['name']):
     for name in config.list_nodes(base + ['name']):
         if config.exists(base + ['name', name, 'rule']):
             for rule in config.list_nodes(base + ['name', name, 'rule']):
                 rule_time = base + ['name', name, 'rule', rule, 'time']
                 rule_tcp_flags = base + ['name', name, 'rule', rule, 'tcp', 'flags']
+                rule_icmp = base + ['name', name, 'rule', rule, 'icmp']
 
                 if config.exists(rule_time + ['monthdays']):
                     config.delete(rule_time + ['monthdays'])
@@ -63,12 +121,26 @@ if config.exists(base + ['name']):
                         else:
                             config.set(rule_tcp_flags + [flag.lower()])
 
+                if config.exists(rule_icmp + ['type-name']):
+                    tmp = config.return_value(rule_icmp + ['type-name'])
+                    if tmp in icmp_remove:
+                        config.delete(rule_icmp + ['type-name'])
+                    elif tmp in icmp_translations:
+                        translate = icmp_translations[tmp]
+                        if isinstance(translate, str):
+                            config.set(rule_icmp + ['type-name'], value=translate)
+                        elif isinstance(translate, list):
+                            config.delete(rule_icmp + ['type-name'])
+                            config.set(rule_icmp + ['type'], value=translate[0])
+                            config.set(rule_icmp + ['code'], value=translate[1])
+
 if config.exists(base + ['ipv6-name']):
     for name in config.list_nodes(base + ['ipv6-name']):
         if config.exists(base + ['ipv6-name', name, 'rule']):
             for rule in config.list_nodes(base + ['ipv6-name', name, 'rule']):
                 rule_time = base + ['ipv6-name', name, 'rule', rule, 'time']
                 rule_tcp_flags = base + ['ipv6-name', name, 'rule', rule, 'tcp', 'flags']
+                rule_icmp = base + ['ipv6-name', name, 'rule', rule, 'icmpv6']
 
                 if config.exists(rule_time + ['monthdays']):
                     config.delete(rule_time + ['monthdays'])
@@ -85,6 +157,31 @@ if config.exists(base + ['ipv6-name']):
                         else:
                             config.set(rule_tcp_flags + [flag.lower()])
 
+                if config.exists(base + ['ipv6-name', name, 'rule', rule, 'protocol']):
+                    tmp = config.return_value(base + ['ipv6-name', name, 'rule', rule, 'protocol'])
+                    if tmp == 'icmpv6':
+                        config.set(base + ['ipv6-name', name, 'rule', rule, 'protocol'], value='ipv6-icmp')
+
+                if config.exists(rule_icmp + ['type']):
+                    tmp = config.return_value(rule_icmp + ['type'])
+                    type_code_match = re.match(r'^(\d+)/(\d+)$', tmp)
+
+                    if type_code_match:
+                        config.set(rule_icmp + ['type'], value=type_code_match[1])
+                        config.set(rule_icmp + ['code'], value=type_code_match[2])
+                    elif tmp in icmpv6_remove:
+                        config.delete(rule_icmp + ['type'])
+                    elif tmp in icmpv6_translations:
+                        translate = icmpv6_translations[tmp]
+                        if isinstance(translate, str):
+                            config.delete(rule_icmp + ['type'])
+                            config.set(rule_icmp + ['type-name'], value=translate)
+                        elif isinstance(translate, list):
+                            config.set(rule_icmp + ['type'], value=translate[0])
+                            config.set(rule_icmp + ['code'], value=translate[1])
+                    else:
+                        config.rename(rule_icmp + ['type'], 'type-name')
+
 try:
     with open(file_name, 'w') as f:
         f.write(config.to_string())