From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id A2FA11FF0AA for ; Tue, 03 Nov 2026 09:44:15 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 08A612185B; Tue, 03 Nov 2026 09:43:47 +0100 (CET) From: Arthur Bied-Charreton To: pve-devel@lists.proxmox.com Subject: [PATCH pve-firewall v5 05/27] firewall: parser: do not log errors for disabled rules Date: Tue, 3 Nov 2026 09:43:06 +0100 Message-ID: <20261103084328.203492-6-a.bied-charreton@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261103084328.203492-1-a.bied-charreton@proxmox.com> References: <20261103084328.203492-1-a.bied-charreton@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793695419275 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.773 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: QCMHEKSF7KIZO3BKMEQ26VV7JPVIGWX4 X-Message-ID-Hash: QCMHEKSF7KIZO3BKMEQ26VV7JPVIGWX4 X-MailFrom: a.bied-charreton@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The rule parser always logged errors when encountering them, even if the offending rule was disabled. The following commits add functionality to automatically disable rules with dangling references to ipsets or aliases. Avoid logging errors for disabled rules since that will then become an expected state. Signed-off-by: Arthur Bied-Charreton --- src/PVE/Firewall.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index 20e0250..c4fcc2e 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -3417,7 +3417,7 @@ sub parse_fw_rule { die "unable to parse rule parameters: $line\n" if length($line); $rule = verify_rule($rule, $cluster_conf, $fw_conf, $rule_env, 1); - if ($rule->{errors}) { + if ($rule->{enable} && $rule->{errors}) { # The verbose flag really means we're running from the CLI and want # output on the console - in the other case we really want such errors # to go into the syslog instead. -- 2.47.3