From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id D936D1FF0B3 for ; Fri, 25 Sep 2026 11:43:16 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 6117221750; Fri, 25 Sep 2026 11:42:37 +0200 (CEST) From: Arthur Bied-Charreton To: pve-devel@lists.proxmox.com subject: SPAM: [PATCH container/firewall/manager/network/qemu-server v3 00/16] handle dangling references when firewall objects go away Date: Fri, 25 Sep 2026 11:42:14 +0200 Message-ID: <20260925094230.844917-1-a.bied-charreton@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 5 AWL -2.650 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods POISEN_SPAM_PILL 0.1 Meta: its spam POISEN_SPAM_PILL_1 0.1 random spam to be learned in bayes POISEN_SPAM_PILL_3 0.1 random spam to be learned in bayes RDNS_NONE 1.274 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record URIBL_DBL_SPAM 5 Contains a spam URL listed in the Spamhaus DBL blocklist [sdn.pm] Message-ID-Hash: IEQLND7BCCQJRHO6JWVGNLQEFXUUU2YI X-Message-ID-Hash: IEQLND7BCCQJRHO6JWVGNLQEFXUUU2YI X-MailFrom: abied-charreton@jett.proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Renaming or deleting a firewall object (an IPSet or an alias) that rules still reference leaves those references dangling. The firewall fails to parse the affected rules and drops them from the generated ruleset, so an edit in one place can disable a whole set of rules somewhere. This is especially bad in the rename case, where one might reasonably expect the references to follow the new object name. This series makes the affected operations offer to deal with the references instead of leaving them behind. pve-firewall gains a shared helper, update_refs(), whcih finds references in rules, security groups and IPset members and applies one of three actions: 'rename' points them at the new name, 'disable' disables the referencing rules, and 'drop' removes them. An IPSet member has no disabled state, so 'disable' removes members as well. For a cluster object, the helper also walks every downstream config in the cluster (guest, host and vnet), locking and saving each one. On top of this, three wrappers cover the SDN-generated IPSets that no caller can delete directly. These options are added to the API as follows: POST .../firewall/ipset update-references no|yes|force PUT .../firewall/aliases/{name} update-references no|yes|force DELETE .../ipset/{name} dangling-references keep|disable|drop DELETE .../aliases/{name} dangling-references keep|disable|drop PUT /cluster/sdn dangling-ipset-references keep|disable|drop DELETE /nodes/{node}/qemu/{vmid} dangling-ipset-references keep|disable|drop DELETE /nodes/{node}/lxc/{vmid} dangling-ipset-references keep|disable|drop On a rename, the new object is persisted before its references are rewritten, so a concurrent compilation does not observe a reference to an object that does not exist yet. If a cluster-wide rewrite is interrupted part way, passing 'force' resumes it (without this, the next attempt would fail due to the target name already existing in the config). While these options allow to trigger changes to the firewall configurations from other endpoints requiring different permissions, like guest destroy and SDN apply, they do not require any additional permissions, see full explanation here [0]. Changes since [v2]: - Handle references to SDN-generated IPSets in SDN apply and guest destroy - Support disabling rules referencing a deleted object instead of only deleting them [v2] https://lore.proxmox.com/pve-devel/20260818133413.450776-1-a.bied-charreton@proxmox.com/ [v1] https://lore.proxmox.com/pve-devel/20260407073658.90818-1-a.bied-charreton@proxmox.com/ [0] https://lore.proxmox.com/pve-devel/awaoshjzbr7adisjngsrcts4zs3hxgoxw2lgcoq66gtiap3al2@mpxrbmtyfcwj/ pve-firewall: Arthur Bied-Charreton (7): helpers: add helpers to update firewall object references parser: do not log errors for disabled rules api: ipset: add option to update references on edit api: ipset: add option to handle dangling references on delete api: aliases: add option to update references on edit api: aliases: add option to handle dangling references on delete firewall: tests: add tests for object reference update logic src/PVE/API2/Firewall/Aliases.pm | 63 ++++++- src/PVE/API2/Firewall/IPSet.pm | 83 +++++++-- src/PVE/Firewall.pm | 2 +- src/PVE/Firewall/Helpers.pm | 308 +++++++++++++++++++++++++++++++ test/Makefile | 1 + test/referenceupdatetests.pl | 296 +++++++++++++++++++++++++++++ 6 files changed, 737 insertions(+), 16 deletions(-) create mode 100755 test/referenceupdatetests.pl pve-network: Arthur Bied-Charreton (1): apply: add option to handle dangling references on VNet deletion src/PVE/API2/Network/SDN.pm | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) qemu-server: Arthur Bied-Charreton (1): api: destroy_vm: add option to handle dangling IPSet references src/PVE/API2/Qemu.pm | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) pve-container: Arthur Bied-Charreton (1): api: destroy_vm: add option to handle dangling IPSet references src/PVE/API2/LXC.pm | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) pve-manager: Arthur Bied-Charreton (6): ui: firewall: add common widgets for deleting and updating references ui: firewall: ipset: add controls to update/delete references on edit ui: firewall: aliases: add controls to update/delete references on edit ui: sdn: apply: add control for dangling IPSet references ui: guest destroy: use let for non-constant variable bindings ui: guest destroy: add control for dangling IPSet references www/manager6/Makefile | 1 + www/manager6/grid/FirewallAliases.js | 80 ++++++++---- www/manager6/grid/FirewallObjectCommon.js | 143 ++++++++++++++++++++++ www/manager6/panel/IPSet.js | 35 +++++- www/manager6/sdn/StatusView.js | 105 +++++++++++++--- www/manager6/window/SafeDestroyGuest.js | 48 +++++++- 6 files changed, 364 insertions(+), 48 deletions(-) create mode 100644 www/manager6/grid/FirewallObjectCommon.js Summary over all repositories: 15 files changed, 1169 insertions(+), 64 deletions(-) -- Generated by murpp 0.12.1