From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 8546D1FF0E3 for ; Tue, 27 Oct 2026 10:00:12 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 7AEEC219A6; Tue, 27 Oct 2026 09:56:37 +0100 (CET) From: Hannes Laimer To: pve-devel@lists.proxmox.com Subject: [PATCH pve-network v3 29/45] sdn: microseg: allow nesting groups under a parent Date: Tue, 27 Oct 2026 09:55:11 +0100 Message-ID: <20261027085527.702738-30-h.laimer@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261027085527.702738-1-h.laimer@proxmox.com> References: <20261027085527.702738-1-h.laimer@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793091365000 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.667 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) KAM_MAILER 2 Automated Mailer Tag Left in Email RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: 5F3H4EUGM5YEBCQWW7JYDJXRDDADYUN3 X-Message-ID-Hash: 5F3H4EUGM5YEBCQWW7JYDJXRDDADYUN3 X-MailFrom: h.laimer@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: A group can name a parent group. An interface in a subgroup then belongs to every group above it as well. The parent can be changed or removed on an existing group, since a referenced group cannot be deleted and created again. At a priority tie an all or exact rule on a subgroup outranks the same rule on its parent. The specificity of such a rule counts the parents of its groups, so the rule alone does not show it. The listing of all microseg objects reports it for each rule. Signed-off-by: Hannes Laimer --- src/PVE/API2/Network/SDN/Microseg.pm | 11 +++++++++++ src/PVE/Network/SDN/Microseg.pm | 13 +++++++++++-- 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/src/PVE/API2/Network/SDN/Microseg.pm b/src/PVE/API2/Network/SDN/Microseg.pm index 5d4062f7db30..e01989d9a923 100644 --- a/src/PVE/API2/Network/SDN/Microseg.pm +++ b/src/PVE/API2/Network/SDN/Microseg.pm @@ -132,6 +132,15 @@ __PACKAGE__->register_method({ . ' in evaluation order and assignments in match order. The' . ' first has the lowest number.', }, + specificity => { + type => 'integer', + optional => 1, + description => + "The number of groups the rule's 'all' and 'exact' predicates" + . ' require, the parents of a named group included. At a priority' + . ' tie the rules with the highest number decide. Rule objects' + . ' only.', + }, $OBJECT_PROPERTIES->%*, }, }, @@ -206,10 +215,12 @@ __PACKAGE__->register_method({ PVE::Network::SDN::Microseg::audited_guest_inventory(), ); my $rank = { $config->rule_order()->%*, $config->assignment_order()->%* }; + my $specificity = $config->rule_specificity(); for my $object (@$objects) { my $id = $object->{id}; $object->{members} = $members->{$id} if defined($members->{$id}); $object->{rank} = $rank->{$id} if defined($rank->{$id}); + $object->{specificity} = $specificity->{$id} if defined($specificity->{$id}); } my $registry = ($running_cfg->{microseg} // {})->{identities}; diff --git a/src/PVE/Network/SDN/Microseg.pm b/src/PVE/Network/SDN/Microseg.pm index c5023c17b1d9..0732577dc42d 100644 --- a/src/PVE/Network/SDN/Microseg.pm +++ b/src/PVE/Network/SDN/Microseg.pm @@ -100,11 +100,19 @@ sub group_properties { my ($update) = @_; my $properties = { + parent => { + type => 'string', + format => 'pve-sdn-microseg-id', + optional => 1, + description => "The group this one is a subgroup of. An interface in a subgroup is" + . " also in every group above it, so 'any' and 'all' rules on a group cover" + . " its subgroups, while rules on the subgroup cover only the subgroup.", + }, comment => $COMMENT_PROPERTY, }; if ($update) { - $properties->{delete} = delete_property('comment'); + $properties->{delete} = delete_property('parent', 'comment'); } return $properties; @@ -128,7 +136,8 @@ sub rule_properties { optional => 1, ($update ? () : (default => 0)), description => "Priority. The highest-priority matching rule wins." - . " At a tie, a deny overrides an allow." + . " At a tie the most specific rules decide, and among equally specific ones" + . " a deny overrides an allow." . " A narrowed rule is checked ahead of an unnarrowed rule at the same priority.", }, comment => $COMMENT_PROPERTY, -- 2.47.3