From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 37A891FF0B3 for ; Wed, 11 Nov 2026 14:19:53 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 8413E216F4; Wed, 11 Nov 2026 14:19:20 +0100 (CET) From: Arthur Bied-Charreton To: pve-devel@lists.proxmox.com Subject: [PATCH pve-firewall v6 10/28] firewall: aliases: add option to handle dangling references on delete Date: Wed, 11 Nov 2026 14:18:43 +0100 Message-ID: <20261111131901.1791124-11-a.bied-charreton@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261111131901.1791124-1-a.bied-charreton@proxmox.com> References: <20261111131901.1791124-1-a.bied-charreton@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1794403148344 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.650 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: PO6T5NIBFJ3MKHLV5DOUDZBZHDSPMH4G X-Message-ID-Hash: PO6T5NIBFJ3MKHLV5DOUDZBZHDSPMH4G X-MailFrom: a.bied-charreton@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Deleting an alias referenced by rules, security groups or ipset members leaves dangling references, which the firewall fails to parse and drops. Add a 'dangling-references' option to the delete endpoint, to either 'disable' the referencing rules or 'drop' them along with the alias. The default, 'keep', leaves them as they are. Ipset members have no disabled state, so they are removed in both cases. For cluster aliases, this also covers all downstream configs (host, guest and vnet). Signed-off-by: Arthur Bied-Charreton --- src/PVE/API2/Firewall/Aliases.pm | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/PVE/API2/Firewall/Aliases.pm b/src/PVE/API2/Firewall/Aliases.pm index 90fe95f..cdbe68c 100644 --- a/src/PVE/API2/Firewall/Aliases.pm +++ b/src/PVE/API2/Firewall/Aliases.pm @@ -325,6 +325,7 @@ sub register_delete_alias { $properties->{name} = $api_properties->{name}; $properties->{digest} = get_standard_option('pve-config-digest'); + $properties->{'dangling-references'} = get_standard_option('pve-dangling-references-delete'); $class->register_method({ name => 'remove_alias', @@ -353,6 +354,20 @@ sub register_delete_alias { PVE::Tools::assert_if_modified($digest, $param->{digest}); my $name = lc($param->{name}); + raise_param_exc({ name => "no such alias" }) if !$aliases->{$name}; + + my $action = $param->{'dangling-references'} + // $properties->{'dangling-references'}->{default}; + + update_refs({ + conf => $fw_conf, + kind => 'aliases', + old => $param->{name}, + env => $class->rule_env(), + action => $action eq 'keep' ? undef : $action, + subject => "alias '$param->{name}' deleted", + }); + delete $aliases->{$name}; $class->save_aliases($param, $fw_conf, $aliases); -- 2.47.3