From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id ACB121FF14C for ; Fri, 26 Jun 2026 12:53:26 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id BD9F7C5B2; Fri, 26 Jun 2026 12:53:24 +0200 (CEST) From: David Riley To: pve-devel@lists.proxmox.com Subject: [PATCH access-control/network v4 0/5] fix #7520: sdn: prune orphaned ACLs and handle VNet migrations Date: Fri, 26 Jun 2026 12:52:53 +0200 Message-ID: <20260626105258.56914-1-d.riley@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1782471192561 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.149 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [proxmox.com,accesscontrol.pm,sdn.pm] Message-ID-Hash: A63E7EBMYIZ4CS4XH2GS5II2H4M4S5EN X-Message-ID-Hash: A63E7EBMYIZ4CS4XH2GS5II2H4M4S5EN X-MailFrom: d.riley@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Implement a pruning mechanism to clean up orphaned SDN ACL entries by comparing the running configuration with the newly compiled state during configuration commit. This ensures state consistency for manual applies via the UI/API as well as during the automatic configuration reload on system boot. The pruning covers: * Zones * VNets * Fabrics * Controllers * Route maps * Prefix lists IPAMs and DNS are excluded as they are not staged. Difference from v3: * Refactored tests * Perl style guide refactor (for instead of foreach) * Update: route_map_suffix regex used for detecting digits to match style guide recommendation Difference from v2: * Relocate VNet ACLs to the new zone path when a VNet is moved, including a validation check to abort on path conflicts. * Refactor diff generation in preparation for an upcoming patch series, resolving #7294 [0]. The upcoming series will hook into the VNet diff to clean up pool members. * Add unit testing for pruning and migration mechanism Link: https://bugzilla.proxmox.com/show_bug.cgi?id=7520 [0] https://bugzilla.proxmox.com/show_bug.cgi?id=7294 pve-access-control: David Riley (4): fix: #7520: sdn: prune orphaned ACLs on resource deletion fix #7520: test: add unit tests for sdn acl pruning logic fix: #7520: sdn: add VNet ACL migration fix #7520: test: add unit tests for sdn acl migration logic src/PVE/AccessControl.pm | 147 +++++++++++++++++++++++ src/test/Makefile | 3 + src/test/sdn_acl_migration_test.pl | 183 +++++++++++++++++++++++++++++ src/test/sdn_acl_pruning_test.pl | 148 +++++++++++++++++++++++ 4 files changed, 481 insertions(+) create mode 100644 src/test/sdn_acl_migration_test.pl create mode 100644 src/test/sdn_acl_pruning_test.pl pve-network: David Riley (1): fix #7520: config: prune orphaned ACLs and relocate moved VNets src/PVE/Network/SDN.pm | 141 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 141 insertions(+) Summary over all repositories: 5 files changed, 622 insertions(+), 0 deletions(-) -- Generated by murpp 0.11.0