From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 4BEA41FF0C2 for ; Thu, 22 Oct 2026 14:47:33 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 4F08321789; Thu, 22 Oct 2026 14:47:22 +0200 (CEST) From: Arthur Bied-Charreton To: pve-devel@lists.proxmox.com Subject: [PATCH pve-firewall v4 05/27] firewall: parser: do not log errors for disabled rules Date: Thu, 22 Oct 2026 14:46:46 +0200 Message-ID: <20261022124708.429069-6-a.bied-charreton@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261022124708.429069-1-a.bied-charreton@proxmox.com> References: <20261022124708.429069-1-a.bied-charreton@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1792673236902 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.924 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: U3VEEDLSONKKYMCSS3YL35AQTDJ2Q2YR X-Message-ID-Hash: U3VEEDLSONKKYMCSS3YL35AQTDJ2Q2YR X-MailFrom: a.bied-charreton@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The rule parser always logged errors when encountering them, even if the offending rule was disabled. The following commits add functionality to automatically disable rules with dangling references to ipsets or aliases. Avoid logging errors for disabled rules since that will then become an expected state. Signed-off-by: Arthur Bied-Charreton --- src/PVE/Firewall.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index da6976e..a01738c 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -3384,7 +3384,7 @@ sub parse_fw_rule { die "unable to parse rule parameters: $line\n" if length($line); $rule = verify_rule($rule, $cluster_conf, $fw_conf, $rule_env, 1); - if ($rule->{errors}) { + if ($rule->{enable} && $rule->{errors}) { # The verbose flag really means we're running from the CLI and want # output on the console - in the other case we really want such errors # to go into the syslog instead. -- 2.47.3