From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 6C0E31FF0E9 for ; Thu, 16 Jul 2026 12:43:04 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id BA4F021405; Thu, 16 Jul 2026 12:43:03 +0200 (CEST) From: David Riley To: pve-devel@lists.proxmox.com Subject: [PATCH access-control/network v6 0/8] fix #7520: sdn: prune orphaned ACLs and handle VNet migrations Date: Thu, 16 Jul 2026 12:42:39 +0200 Message-ID: <20260716104247.29047-1-d.riley@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1784198559712 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.179 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: 2EDSBQ6ANDTNZWBDZWZ7HQ2OZVYVIJZD X-Message-ID-Hash: 2EDSBQ6ANDTNZWBDZWZ7HQ2OZVYVIJZD X-MailFrom: d.riley@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Thanks @Stefan H. for the review and testing. Difference from v5: * Use the running_config helper. * Add a refactor commit for the compile_running_cfg to also use the running_config helper. * The comment for find_acl_tree_node_parent now uses the POD format. * Remove 'use strict;' and 'use warning;' in the pruning and migration test as this is implied by 'use v5.36' * Update the warning message in the migration logic to reflect the behaviour of the actual check. Difference from v4: * Instead of passing arrays of path segments [, ], paths are now passed as strings / to match the actual ACL paths as there was no real benefit of using arrays. * Moved helper functions into seperate commits and updated the commit messages accordingly. * Fix: style nits (post if, for loop dereferencing, ...) * Fix: tests nits (grouped mocking, removed main subroutine) Difference from v3: * Refactored tests * Perl style guide refactor (for instead of foreach) * Update: route_map_suffix regex used for detecting digits to match style guide recommendation Difference from v2: * Relocate VNet ACLs to the new zone path when a VNet is moved, including a validation check to abort on path conflicts. * Refactor diff generation in preparation for an upcoming patch series, resolving #7294 [0]. The upcoming series will hook into the VNet diff to clean up pool members. * Add unit testing for pruning and migration mechanism === Original Cover Letter === Implement a pruning mechanism to clean up orphaned SDN ACL entries by comparing the running configuration with the newly compiled state during configuration commit. This ensures state consistency for manual applies via the UI/API as well as during the automatic configuration reload on system boot. The pruning covers: * Zones * VNets * Fabrics * Controllers * Route maps * Prefix lists IPAMs and DNS are excluded as they are not staged. Link: https://bugzilla.proxmox.com/show_bug.cgi?id=7520 [0] https://bugzilla.proxmox.com/show_bug.cgi?id=7294 pve-access-control: David Riley (6): permission: add acl tree node parent lookup without node creation fix #7520: sdn: add pruning SDN resources ACLs test: add sdn acl pruning tests permission: add helper to check for active permissions fix #7520: sdn: add VNet ACL migration test: add sdn acl migration tests src/PVE/AccessControl.pm | 160 +++++++++++++++++++++++++++ src/test/Makefile | 3 + src/test/sdn_acl_migration_test.pl | 169 +++++++++++++++++++++++++++++ src/test/sdn_acl_pruning_test.pl | 132 ++++++++++++++++++++++ 4 files changed, 464 insertions(+) create mode 100644 src/test/sdn_acl_migration_test.pl create mode 100644 src/test/sdn_acl_pruning_test.pl pve-network: David Riley (2): sdn: refactor compile_running_cfg to use running_config helper fix #7520: config: prune orphaned and relocate moved VNet ACLs src/PVE/Network/SDN.pm | 117 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 116 insertions(+), 1 deletion(-) Summary over all repositories: 5 files changed, 580 insertions(+), 1 deletions(-) -- Generated by murpp 0.11.0