From: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [PATCH pve-firewall v4 01/27] firewall: move object reference helpers to their own module
Date: Thu, 22 Oct 2026 14:46:42 +0200 [thread overview]
Message-ID: <20261022124708.429069-2-a.bied-charreton@proxmox.com> (raw)
In-Reply-To: <20261022124708.429069-1-a.bied-charreton@proxmox.com>
The following commits add a lot of functionality related to handling
references to firewall objects in the different configuration files.
Create a new PVE::Firewall::References module grouping this
functionality instead of accumulating it in the generic Helpers module,
and move collect_refs() there.
No functional changes intended.
Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
src/PVE/API2/Firewall/Cluster.pm | 6 ++--
src/PVE/API2/Firewall/VM.pm | 7 +++--
src/PVE/Firewall/Helpers.pm | 38 -------------------------
src/PVE/Firewall/Makefile | 2 +-
src/PVE/Firewall/References.pm | 48 ++++++++++++++++++++++++++++++++
5 files changed, 57 insertions(+), 44 deletions(-)
create mode 100644 src/PVE/Firewall/References.pm
diff --git a/src/PVE/API2/Firewall/Cluster.pm b/src/PVE/API2/Firewall/Cluster.pm
index ebd955d..62f596d 100644
--- a/src/PVE/API2/Firewall/Cluster.pm
+++ b/src/PVE/API2/Firewall/Cluster.pm
@@ -6,6 +6,7 @@ use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
use PVE::JSONSchema qw(get_standard_option);
use PVE::Firewall;
+use PVE::Firewall::References;
use PVE::API2::Firewall::Aliases;
use PVE::API2::Firewall::Rules;
use PVE::API2::Firewall::Groups;
@@ -273,8 +274,9 @@ __PACKAGE__->register_method({
my $allowed_vnets = PVE::API2::Firewall::Helpers::get_allowed_vnets();
my $sdn_conf = PVE::Firewall::load_sdn_conf($allowed_vms, $allowed_vnets);
- my $cluster_refs = PVE::Firewall::Helpers::collect_refs($conf, $param->{type}, "dc");
- my $sdn_refs = PVE::Firewall::Helpers::collect_refs($sdn_conf, $param->{type}, "sdn");
+ my $cluster_refs = PVE::Firewall::References::collect_refs($conf, $param->{type}, "dc");
+ my $sdn_refs =
+ PVE::Firewall::References::collect_refs($sdn_conf, $param->{type}, "sdn");
return [@$sdn_refs, @$cluster_refs];
},
diff --git a/src/PVE/API2/Firewall/VM.pm b/src/PVE/API2/Firewall/VM.pm
index c3a5acc..0c556b9 100644
--- a/src/PVE/API2/Firewall/VM.pm
+++ b/src/PVE/API2/Firewall/VM.pm
@@ -7,6 +7,7 @@ use PVE::Exception qw(raise_param_exc);
use PVE::JSONSchema qw(get_standard_option);
use PVE::Cluster;
use PVE::Firewall;
+use PVE::Firewall::References;
use PVE::API2::Firewall::Rules;
use PVE::API2::Firewall::Helpers;
use PVE::API2::Firewall::Aliases;
@@ -300,11 +301,11 @@ sub register_handlers {
my $sdn_conf = PVE::Firewall::load_sdn_conf($allowed_vms, $allowed_vnets);
my $dc_refs =
- PVE::Firewall::Helpers::collect_refs($cluster_conf, $param->{type}, 'dc');
+ PVE::Firewall::References::collect_refs($cluster_conf, $param->{type}, 'dc');
my $sdn_refs =
- PVE::Firewall::Helpers::collect_refs($sdn_conf, $param->{type}, "sdn");
+ PVE::Firewall::References::collect_refs($sdn_conf, $param->{type}, "sdn");
my $vm_refs =
- PVE::Firewall::Helpers::collect_refs($fw_conf, $param->{type}, 'guest');
+ PVE::Firewall::References::collect_refs($fw_conf, $param->{type}, 'guest');
return [@$dc_refs, @$sdn_refs, @$vm_refs];
},
diff --git a/src/PVE/Firewall/Helpers.pm b/src/PVE/Firewall/Helpers.pm
index fa3646c..eb8b58a 100644
--- a/src/PVE/Firewall/Helpers.pm
+++ b/src/PVE/Firewall/Helpers.pm
@@ -16,7 +16,6 @@ our @EXPORT_OK = qw(
lock_vmfw_conf
remove_vmfw_conf
clone_vmfw_conf
- collect_refs
flush_fw_ct_entries_by_mark
);
@@ -153,43 +152,6 @@ sub dump_fw_logfile {
return ($state{'count'}, $state{'lines'});
}
-sub collect_refs {
- my ($conf, $type, $scope) = @_;
-
- my $res = [];
-
- if (!$type || $type eq 'ipset') {
- foreach my $name (keys %{ $conf->{ipset} }) {
- my $data = {
- type => 'ipset',
- name => $name,
- ref => "+$name",
- scope => $scope,
- };
- if (my $comment = $conf->{ipset_comments}->{$name}) {
- $data->{comment} = $comment;
- }
- push @$res, $data;
- }
- }
-
- if (!$type || $type eq 'alias') {
- foreach my $name (keys %{ $conf->{aliases} }) {
- my $e = $conf->{aliases}->{$name};
- my $data = {
- type => 'alias',
- name => $name,
- ref => $name,
- scope => $scope,
- };
- $data->{comment} = $e->{comment} if $e->{comment};
- push @$res, $data;
- }
- }
-
- return $res;
-}
-
# This is checked in proxmox-firewall to avoid log-spam due to failing to parse the config
our $FORCE_NFT_DISABLE_FLAG_FILE = "/run/proxmox-nftables-firewall-force-disable";
diff --git a/src/PVE/Firewall/Makefile b/src/PVE/Firewall/Makefile
index 3274bc6..6c1dae4 100644
--- a/src/PVE/Firewall/Makefile
+++ b/src/PVE/Firewall/Makefile
@@ -2,7 +2,7 @@ DESTDIR=
PREFIX=/usr
PERLDIR=$(DESTDIR)/$(PREFIX)/share/perl5
-SOURCES=Helpers.pm
+SOURCES=Helpers.pm References.pm
.PHONY: install
install: $(SOURCES)
diff --git a/src/PVE/Firewall/References.pm b/src/PVE/Firewall/References.pm
new file mode 100644
index 0000000..a4ea967
--- /dev/null
+++ b/src/PVE/Firewall/References.pm
@@ -0,0 +1,48 @@
+package PVE::Firewall::References;
+
+use strict;
+use warnings;
+
+use base 'Exporter';
+our @EXPORT_OK = qw(
+ collect_refs
+);
+
+sub collect_refs {
+ my ($conf, $type, $scope) = @_;
+
+ my $res = [];
+
+ if (!$type || $type eq 'ipset') {
+ foreach my $name (keys %{ $conf->{ipset} }) {
+ my $data = {
+ type => 'ipset',
+ name => $name,
+ ref => "+$name",
+ scope => $scope,
+ };
+ if (my $comment = $conf->{ipset_comments}->{$name}) {
+ $data->{comment} = $comment;
+ }
+ push @$res, $data;
+ }
+ }
+
+ if (!$type || $type eq 'alias') {
+ foreach my $name (keys %{ $conf->{aliases} }) {
+ my $e = $conf->{aliases}->{$name};
+ my $data = {
+ type => 'alias',
+ name => $name,
+ ref => $name,
+ scope => $scope,
+ };
+ $data->{comment} = $e->{comment} if $e->{comment};
+ push @$res, $data;
+ }
+ }
+
+ return $res;
+}
+
+1;
--
2.47.3
next prev parent reply other threads:[~2026-10-22 12:47 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-22 12:46 [PATCH container/docs/firewall/manager/network/qemu-server v4 00/27] handle dangling references when firewall objects go away Arthur Bied-Charreton
2026-10-22 12:46 ` Arthur Bied-Charreton [this message]
2026-10-22 12:46 ` [PATCH pve-firewall v4 02/27] firewall: references: add helpers to update object references Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 03/27] firewall: references: log the references an object update touched Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 04/27] firewall: references: add wrappers for the SDN-generated IPSets Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 05/27] firewall: parser: do not log errors for disabled rules Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 06/27] firewall: ipset: add option to handle dangling references on rename Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 07/27] firewall: ipset: add option to handle dangling references on delete Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 08/27] firewall: aliases: add option to handle dangling references on rename Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 09/27] firewall: aliases: add option to handle dangling references on delete Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 10/27] firewall: api: run reference updates as tasks Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 11/27] firewall: tests: add tests for object reference updates Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 12/27] firewall: references: handle security groups Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 13/27] firewall: groups: add option to handle dangling references on rename Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-firewall v4 14/27] fix #8176: firewall: groups: handle dangling references on delete Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-network v4 15/27] apply: add option to handle dangling references on VNet deletion Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH qemu-server v4 16/27] api: destroy_vm: add option to handle dangling IPSet references Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-container v4 17/27] " Arthur Bied-Charreton
2026-10-22 12:46 ` [PATCH pve-docs v4 18/27] firewall: remove trailing spaces Arthur Bied-Charreton
2026-10-22 12:47 ` [PATCH pve-docs v4 19/27] firewall: document renaming and removing objects Arthur Bied-Charreton
2026-10-22 12:47 ` [PATCH pve-manager v4 20/27] ui: firewall: add a common widget for handling dangling references Arthur Bied-Charreton
2026-10-22 12:47 ` [PATCH pve-manager v4 21/27] ui: firewall: ipset: add controls for " Arthur Bied-Charreton
2026-10-22 12:47 ` [PATCH pve-manager v4 22/27] ui: firewall: aliases: " Arthur Bied-Charreton
2026-10-22 12:47 ` [PATCH pve-manager v4 23/27] ui: sdn: apply: add control for dangling IPSet references Arthur Bied-Charreton
2026-10-22 12:47 ` [PATCH pve-manager v4 24/27] ui: guest destroy: use let for non-constant variable bindings Arthur Bied-Charreton
2026-10-22 12:47 ` [PATCH pve-manager v4 25/27] ui: guest destroy: add control for dangling IPSet references Arthur Bied-Charreton
2026-10-22 12:47 ` [PATCH pve-manager v4 26/27] ui: firewall: show the task for reference updates Arthur Bied-Charreton
2026-10-22 12:47 ` [PATCH pve-manager v4 27/27] ui: firewall: groups: add controls for dangling references Arthur Bied-Charreton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261022124708.429069-2-a.bied-charreton@proxmox.com \
--to=a.bied-charreton@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox