Re: [PATCH pve-access-control v5 5/7] fix #7520: sdn: add VNet ACL migration

[David Riley <d.riley@proxmox.com>]

Thanks for taking a look.

Comments inline.

On 7/15/26 5:00 PM, Stefan Hanreich wrote:
> comments inline
>
> On 7/7/26 2:05 PM, David Riley wrote:
>> Add routine to enable the relocation of ACL entries when their
>> corresponding SDN resources are moved. This prevents stale entries
>> when VNets are moved between zones.
>>
>> This is a preparatory change that does not have an immediate effect on
>> its own, but lays the foundation for safely relocating ACL nodes and
>> rejecting conflicting destination paths.
>>
>> Link: https://bugzilla.proxmox.com/show_bug.cgi?id=7520
>> Signed-off-by: David Riley <d.riley@proxmox.com>
>> ---
>>   src/PVE/AccessControl.pm | 84 ++++++++++++++++++++++++++++++++++++++++
>>   1 file changed, 84 insertions(+)
>>
>> diff --git a/src/PVE/AccessControl.pm b/src/PVE/AccessControl.pm
>> index 1047226..4faeb8f 100644
>> --- a/src/PVE/AccessControl.pm
>> +++ b/src/PVE/AccessControl.pm
>> @@ -2045,6 +2045,90 @@ sub remove_sdn_resource_access {
>>       lock_user_config($delete_resource_fn, "SDN ACL cleanup failed");
>>   }
>>   
>> +sub migrate_sdn_resource_access {
>> +    my ($migrations) = @_;
>> +    # [ { src_path => 'zones/<zoney>/<vnet>', dest_path => 'zones/<zonex>/<vnet>' } ]
> this claims the value is a string
>
>> +
>> +    return if !$migrations;
>> +
>> +    my $migrate_fn = sub {
>> +        my $usercfg = cfs_read_file("user.cfg");
>> +        my $modified = 0;
>> +
>> +        my @prepared_moves = ();
>> +        for my $migration (@$migrations) {
>> +
>> +            my $invalid_key = 0;
>> +
>> +            for my $key (qw(src_path dest_path)) {
>> +                if (!defined($migration->{$key})) {
>> +                    warn "Invalid '$key': must be an array reference.\n";
> but this says it must be an array reference? also, if I misunderstand
> and this should indeed be an array reference then we should explicitly
> check for that?

Nice catch, this was indeed a leftover from an earlier iteration where I used arrays.
I switched to strings in this version, so I'll update the warning to correctly check
for and report missing path keys (e.g.: 'Missing src_path/dest_path') in v6.

>
>> +                    $invalid_key = 1;
>> +                    last;
>> +                }
>> +            }
>> +
>> +            next if $invalid_key;
>> +
>> +            my $src_path = "sdn/$migration->{src_path}";
>> +            my $dest_path = "sdn/$migration->{dest_path}";
>> +
>> +            my ($src_parent, $src_last_key, $acl_node) =
>> +                find_acl_tree_node_parent($usercfg->{acl_root}, $src_path);
>> +
>> +            if (defined($src_parent) && defined($src_last_key) && defined($acl_node)) {
>> +                # probe dest for conflicts
>> +                my (undef, undef, $existing_dest_node) =
>> +                    find_acl_tree_node_parent($usercfg->{acl_root}, $dest_path);
>> +
>> +                if (acl_tree_has_permissions($existing_dest_node)) {
>> +                    my $conflict_path = "/$dest_path";
>> +                    my $source_path = "/$src_path";
>> +                    die
>> +                        "Destination '$conflict_path' already has permissions configured (Source:"
>> +                        . " '$source_path'). Please remove the target ACLs manually before"
>> +                        . " retrying.\n";
>> +                }
>> +
>> +                # stage move
>> +                push(
>> +                    @prepared_moves,
>> +                    {
>> +                        src_parent => $src_parent,
>> +                        src_last_key => $src_last_key,
>> +                        dest_path => $dest_path,
>> +                        node => $acl_node,
>> +                    },
>> +                );
>> +            }
>> +        }
>> +
>> +        for my $move (@prepared_moves) {
>> +            delete $move->{src_parent}->{children}->{ $move->{src_last_key} };
>> +
>> +            my $current = $usercfg->{acl_root};
>> +            my @dest_segments = split('/', $move->{dest_path});
>> +            my $dest_last_key = pop @dest_segments;
>> +
>> +            for my $segment (@dest_segments) {
>> +                $current->{children}->{$segment} = {}
>> +                    if !defined($current->{children}->{$segment});
>> +
>> +                $current = $current->{children}->{$segment};
>> +            }
>> +            $current->{children}->{$dest_last_key} = $move->{node};
>> +
>> +            $modified = 1;
> nit: wouldn't an early return if prepared moves is empty save us from
> tracking this here?


Good point, that simplifies the logic nicely. I'll add an early return if '@prepared_moves'
is empty and drop the '$modified' flag entirely for v6.

>
>> +        }
>> +
>> +        if ($modified) {
>> +            cfs_write_file("user.cfg", $usercfg);
>> +        }
>> +    };
>> +
>> +    lock_user_config($migrate_fn, "ACL migration failed");
>> +}
>> +
>>   my $USER_CONTROLLED_TFA_TYPES = {
>>       u2f => 1,
>>       oath => 1,
>
>
>
>