From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id D34631FF0C2 for ; Thu, 22 Oct 2026 14:47:26 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id EBE3C2174D; Thu, 22 Oct 2026 14:47:21 +0200 (CEST) From: Arthur Bied-Charreton To: pve-devel@lists.proxmox.com Subject: [PATCH pve-firewall v4 04/27] firewall: references: add wrappers for the SDN-generated IPSets Date: Thu, 22 Oct 2026 14:46:45 +0200 Message-ID: <20261022124708.429069-5-a.bied-charreton@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261022124708.429069-1-a.bied-charreton@proxmox.com> References: <20261022124708.429069-1-a.bied-charreton@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1792673236848 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.799 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) POISEN_SPAM_PILL 0.1 Meta: its spam POISEN_SPAM_PILL_1 0.1 random spam to be learned in bayes POISEN_SPAM_PILL_3 0.1 random spam to be learned in bayes RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: D22HFPCBOQZZFJOVXR5TCIVR6UD2AEIX X-Message-ID-Hash: D22HFPCBOQZZFJOVXR5TCIVR6UD2AEIX X-MailFrom: a.bied-charreton@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: SDN generates IPSets that cannot be deleted directly, but rather disappear once the config stops generating them: the 4 IPSets of a VNet go away with the VNet, and a guest's IPAM IPSet goes away once the guest is destroyed. Rules referencing those are left dangling as well. Add update_sdn_ipset_refs() for a list of such IPSets, update_vnet_ipset_refs() for the four IPSets of a VNet, and update_guest_ipam_ipset_refs() for a guest's IPAM IPSet. They lock the cluster config around update_refs(), save it, and log what they changed. The callers are PUT /cluster/sdn in pve-network, and the guest destroy endpoints in qemu-server and pve-container. Signed-off-by: Arthur Bied-Charreton --- src/PVE/Firewall/References.pm | 77 ++++++++++++++++++++++++++++++++++ 1 file changed, 77 insertions(+) diff --git a/src/PVE/Firewall/References.pm b/src/PVE/Firewall/References.pm index fb25bc2..37df434 100644 --- a/src/PVE/Firewall/References.pm +++ b/src/PVE/Firewall/References.pm @@ -458,4 +458,81 @@ sub log_ref_line { return; } +=head3 update_sdn_ipset_refs($ipsets, $action, $subject, $log) + +Apply C<$action> to all references to the SDN-generated IPSets in C<$ipsets>. + +C<$subject> names what made them go away for the log, and C<$log> is where that account goes. + +Return the number of references changed. + +=cut + +sub update_sdn_ipset_refs { + my ($ipsets, $action, $subject, $log) = @_; + + die "SDN IPSets cannot be renamed\n" if $action && $action eq 'rename'; + + my $count = 0; + + PVE::Firewall::lock_clusterfw_conf( + 10, + sub { + my $conf = PVE::Firewall::load_clusterfw_conf(); + + $count = update_refs({ + conf => $conf, + kind => 'ipset', + old => $ipsets, + env => 'sdn', + action => $action, + subject => $subject, + log => $log, + }); + + PVE::Firewall::save_clusterfw_conf($conf); + }, + ); + + return $count; +} + +=head3 update_vnet_ipset_refs($vnets, $action, $log) + +Apply C<$action> to all references to the auto-generated IPSets for C<$vnets>. + +Return the number of references changed. + +=cut + +sub update_vnet_ipset_refs { + my ($vnets, $action, $log) = @_; + + my $ipsets = [ + map { + my $vnet = $_; + map { "$vnet-$_" } qw(all gateway no-gateway dhcp) + } $vnets->@* + ]; + + my $names = join(', ', map { "'$_'" } $vnets->@*); + my $subject = scalar($vnets->@*) > 1 ? "vnets $names removed" : "vnet $names removed"; + + return update_sdn_ipset_refs($ipsets, $action, $subject, $log); +} + +=head3 update_guest_ipam_ipset_refs($vmid, $action) + +Apply C<$action> to all references to the IPAM IPSet of the guest C<$vmid>. + +Return the number of references changed. + +=cut + +sub update_guest_ipam_ipset_refs { + my ($vmid, $action) = @_; + + return update_sdn_ipset_refs("guest-ipam-$vmid", $action, "guest $vmid destroyed"); +} + 1; -- 2.47.3