From a09fab2c8db5b2073cce34620afa35049a85d12e Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Thu, 5 Feb 2026 21:26:00 +0100
Subject: [PATCH] firewall: adjust for parseReplace() for icmp-type "skip";
 closes #9738

Direction was a little tricky.  Would be nice to have tests for this.  ;)
---
 .../library/OPNsense/Firewall/FilterRule.php  |  2 +-
 .../app/library/OPNsense/Firewall/Rule.php    | 23 ++++++++++---------
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/src/opnsense/mvc/app/library/OPNsense/Firewall/FilterRule.php b/src/opnsense/mvc/app/library/OPNsense/Firewall/FilterRule.php
index 1a6041a958..458f053283 100644
--- a/src/opnsense/mvc/app/library/OPNsense/Firewall/FilterRule.php
+++ b/src/opnsense/mvc/app/library/OPNsense/Firewall/FilterRule.php
@@ -54,7 +54,7 @@ class FilterRule extends Rule
         'os' => 'parsePlain, os {","}',
         'to' => 'parsePlainCurly,to ',
         'to_port' => 'parsePlainCurly, port ',
-        'icmp-type' => 'parsePlain,icmp-type {,}',
+        'icmp-type' => 'parseReplaceSimple,skip:"skip",icmp-type {,}',
         'icmp6-type' => 'parsePlain,icmp6-type {,}',
         'flags' => 'parsePlain, flags ',
         'state' => 'parseState',
diff --git a/src/opnsense/mvc/app/library/OPNsense/Firewall/Rule.php b/src/opnsense/mvc/app/library/OPNsense/Firewall/Rule.php
index 696e8d380b..1e60ea5de0 100644
--- a/src/opnsense/mvc/app/library/OPNsense/Firewall/Rule.php
+++ b/src/opnsense/mvc/app/library/OPNsense/Firewall/Rule.php
@@ -1,7 +1,7 @@
 <?php
 
 /*
- * Copyright (C) 2017-2023 Deciso B.V.
+ * Copyright (C) 2017-2026 Deciso B.V.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -228,27 +228,28 @@ abstract class Rule
     }
 
     /**
-     * parse data, use replace map
-     * @param string $value field value
+     * parse data, use replace map for CSV values
+     * @param string $values combined field values
      * @param string $map
      * @param string $prefix
      * @param string $suffix
      * @return string
      */
-    protected function parseReplaceSimple($value, $map, $prefix = "", $suffix = "")
+    protected function parseReplaceSimple($values, $map, $prefix = '', $suffix = '')
     {
-        $retval = $value;
+        $retvals = !is_null($values) && strlen($values) ? explode(',', $values) : [];
         foreach (explode('|', $map) as $item) {
             $tmp = explode(':', $item);
-            if ($tmp[0] == $value) {
-                $retval = $tmp[1] . " ";
-                break;
+            if (in_array($tmp[0], $retvals)) {
+                $retvals[array_search($tmp[0], $retvals)] = $tmp[1];
+            } elseif (!count($retvals) && $tmp[0] === '') {
+                $retvals[] = $tmp[1];
             }
         }
-        if (!empty($retval)) {
-            return $prefix . $retval . $suffix . " ";
+        if (count($retvals)) {
+            return $prefix . join(',', $retvals) . $suffix . ' ';
         } else {
-            return "";
+            return '';
         }
     }