From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 599AC1FF0C2 for ; Thu, 22 Oct 2026 14:47:39 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id B2CD0217AF; Thu, 22 Oct 2026 14:47:22 +0200 (CEST) From: Arthur Bied-Charreton To: pve-devel@lists.proxmox.com Subject: [PATCH pve-firewall v4 01/27] firewall: move object reference helpers to their own module Date: Thu, 22 Oct 2026 14:46:42 +0200 Message-ID: <20261022124708.429069-2-a.bied-charreton@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261022124708.429069-1-a.bied-charreton@proxmox.com> References: <20261022124708.429069-1-a.bied-charreton@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1792673236637 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.942 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: 2ZBPIPISM2IRC47U66X76G43IHS7EY5R X-Message-ID-Hash: 2ZBPIPISM2IRC47U66X76G43IHS7EY5R X-MailFrom: a.bied-charreton@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The following commits add a lot of functionality related to handling references to firewall objects in the different configuration files. Create a new PVE::Firewall::References module grouping this functionality instead of accumulating it in the generic Helpers module, and move collect_refs() there. No functional changes intended. Signed-off-by: Arthur Bied-Charreton --- src/PVE/API2/Firewall/Cluster.pm | 6 ++-- src/PVE/API2/Firewall/VM.pm | 7 +++-- src/PVE/Firewall/Helpers.pm | 38 ------------------------- src/PVE/Firewall/Makefile | 2 +- src/PVE/Firewall/References.pm | 48 ++++++++++++++++++++++++++++++++ 5 files changed, 57 insertions(+), 44 deletions(-) create mode 100644 src/PVE/Firewall/References.pm diff --git a/src/PVE/API2/Firewall/Cluster.pm b/src/PVE/API2/Firewall/Cluster.pm index ebd955d..62f596d 100644 --- a/src/PVE/API2/Firewall/Cluster.pm +++ b/src/PVE/API2/Firewall/Cluster.pm @@ -6,6 +6,7 @@ use PVE::Exception qw(raise raise_param_exc raise_perm_exc); use PVE::JSONSchema qw(get_standard_option); use PVE::Firewall; +use PVE::Firewall::References; use PVE::API2::Firewall::Aliases; use PVE::API2::Firewall::Rules; use PVE::API2::Firewall::Groups; @@ -273,8 +274,9 @@ __PACKAGE__->register_method({ my $allowed_vnets = PVE::API2::Firewall::Helpers::get_allowed_vnets(); my $sdn_conf = PVE::Firewall::load_sdn_conf($allowed_vms, $allowed_vnets); - my $cluster_refs = PVE::Firewall::Helpers::collect_refs($conf, $param->{type}, "dc"); - my $sdn_refs = PVE::Firewall::Helpers::collect_refs($sdn_conf, $param->{type}, "sdn"); + my $cluster_refs = PVE::Firewall::References::collect_refs($conf, $param->{type}, "dc"); + my $sdn_refs = + PVE::Firewall::References::collect_refs($sdn_conf, $param->{type}, "sdn"); return [@$sdn_refs, @$cluster_refs]; }, diff --git a/src/PVE/API2/Firewall/VM.pm b/src/PVE/API2/Firewall/VM.pm index c3a5acc..0c556b9 100644 --- a/src/PVE/API2/Firewall/VM.pm +++ b/src/PVE/API2/Firewall/VM.pm @@ -7,6 +7,7 @@ use PVE::Exception qw(raise_param_exc); use PVE::JSONSchema qw(get_standard_option); use PVE::Cluster; use PVE::Firewall; +use PVE::Firewall::References; use PVE::API2::Firewall::Rules; use PVE::API2::Firewall::Helpers; use PVE::API2::Firewall::Aliases; @@ -300,11 +301,11 @@ sub register_handlers { my $sdn_conf = PVE::Firewall::load_sdn_conf($allowed_vms, $allowed_vnets); my $dc_refs = - PVE::Firewall::Helpers::collect_refs($cluster_conf, $param->{type}, 'dc'); + PVE::Firewall::References::collect_refs($cluster_conf, $param->{type}, 'dc'); my $sdn_refs = - PVE::Firewall::Helpers::collect_refs($sdn_conf, $param->{type}, "sdn"); + PVE::Firewall::References::collect_refs($sdn_conf, $param->{type}, "sdn"); my $vm_refs = - PVE::Firewall::Helpers::collect_refs($fw_conf, $param->{type}, 'guest'); + PVE::Firewall::References::collect_refs($fw_conf, $param->{type}, 'guest'); return [@$dc_refs, @$sdn_refs, @$vm_refs]; }, diff --git a/src/PVE/Firewall/Helpers.pm b/src/PVE/Firewall/Helpers.pm index fa3646c..eb8b58a 100644 --- a/src/PVE/Firewall/Helpers.pm +++ b/src/PVE/Firewall/Helpers.pm @@ -16,7 +16,6 @@ our @EXPORT_OK = qw( lock_vmfw_conf remove_vmfw_conf clone_vmfw_conf - collect_refs flush_fw_ct_entries_by_mark ); @@ -153,43 +152,6 @@ sub dump_fw_logfile { return ($state{'count'}, $state{'lines'}); } -sub collect_refs { - my ($conf, $type, $scope) = @_; - - my $res = []; - - if (!$type || $type eq 'ipset') { - foreach my $name (keys %{ $conf->{ipset} }) { - my $data = { - type => 'ipset', - name => $name, - ref => "+$name", - scope => $scope, - }; - if (my $comment = $conf->{ipset_comments}->{$name}) { - $data->{comment} = $comment; - } - push @$res, $data; - } - } - - if (!$type || $type eq 'alias') { - foreach my $name (keys %{ $conf->{aliases} }) { - my $e = $conf->{aliases}->{$name}; - my $data = { - type => 'alias', - name => $name, - ref => $name, - scope => $scope, - }; - $data->{comment} = $e->{comment} if $e->{comment}; - push @$res, $data; - } - } - - return $res; -} - # This is checked in proxmox-firewall to avoid log-spam due to failing to parse the config our $FORCE_NFT_DISABLE_FLAG_FILE = "/run/proxmox-nftables-firewall-force-disable"; diff --git a/src/PVE/Firewall/Makefile b/src/PVE/Firewall/Makefile index 3274bc6..6c1dae4 100644 --- a/src/PVE/Firewall/Makefile +++ b/src/PVE/Firewall/Makefile @@ -2,7 +2,7 @@ DESTDIR= PREFIX=/usr PERLDIR=$(DESTDIR)/$(PREFIX)/share/perl5 -SOURCES=Helpers.pm +SOURCES=Helpers.pm References.pm .PHONY: install install: $(SOURCES) diff --git a/src/PVE/Firewall/References.pm b/src/PVE/Firewall/References.pm new file mode 100644 index 0000000..a4ea967 --- /dev/null +++ b/src/PVE/Firewall/References.pm @@ -0,0 +1,48 @@ +package PVE::Firewall::References; + +use strict; +use warnings; + +use base 'Exporter'; +our @EXPORT_OK = qw( + collect_refs +); + +sub collect_refs { + my ($conf, $type, $scope) = @_; + + my $res = []; + + if (!$type || $type eq 'ipset') { + foreach my $name (keys %{ $conf->{ipset} }) { + my $data = { + type => 'ipset', + name => $name, + ref => "+$name", + scope => $scope, + }; + if (my $comment = $conf->{ipset_comments}->{$name}) { + $data->{comment} = $comment; + } + push @$res, $data; + } + } + + if (!$type || $type eq 'alias') { + foreach my $name (keys %{ $conf->{aliases} }) { + my $e = $conf->{aliases}->{$name}; + my $data = { + type => 'alias', + name => $name, + ref => $name, + scope => $scope, + }; + $data->{comment} = $e->{comment} if $e->{comment}; + push @$res, $data; + } + } + + return $res; +} + +1; -- 2.47.3