From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 910CB1FF0AA for ; Tue, 03 Nov 2026 09:44:23 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 6E4DD21889; Tue, 03 Nov 2026 09:43:47 +0100 (CET) From: Arthur Bied-Charreton To: pve-devel@lists.proxmox.com Subject: [PATCH pve-firewall v5 07/27] firewall: ipset: add option to handle dangling references on delete Date: Tue, 3 Nov 2026 09:43:08 +0100 Message-ID: <20261103084328.203492-8-a.bied-charreton@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261103084328.203492-1-a.bied-charreton@proxmox.com> References: <20261103084328.203492-1-a.bied-charreton@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793695419392 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.768 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: VSUOSU555BXRUDCW3BXQORP2ABKIMEIB X-Message-ID-Hash: VSUOSU555BXRUDCW3BXQORP2ABKIMEIB X-MailFrom: a.bied-charreton@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Deleting an ipset referenced by rules or security groups leaves dangling references, which the firewall fails to parse and drops. Add a 'dangling-references' option to the delete endpoint, to either 'disable' the referencing rules or 'drop' them along with the ipset. The default, 'keep', leaves them as they are. For cluster ipsets, this also covers all downstream configs (host, guest and vnet). Signed-off-by: Arthur Bied-Charreton --- src/PVE/API2/Firewall/IPSet.pm | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/src/PVE/API2/Firewall/IPSet.pm b/src/PVE/API2/Firewall/IPSet.pm index a6a44be..fe4f8c9 100644 --- a/src/PVE/API2/Firewall/IPSet.pm +++ b/src/PVE/API2/Firewall/IPSet.pm @@ -2,6 +2,7 @@ package PVE::API2::Firewall::IPSetBase; use strict; use warnings; +use PVE::Firewall::References qw(update_refs); use PVE::Exception qw(raise raise_param_exc); use PVE::JSONSchema qw(get_standard_option); @@ -140,6 +141,15 @@ sub register_delete_ipset { optional => 1, description => 'Delete all members of the IPSet, if there are any.', }; + $properties->{'dangling-references'} = { + type => 'string', + enum => ['keep', 'disable', 'drop'], + optional => 1, + description => + "Handle references that the deletion would leave dangling. Use 'disable' to disable " + . "the referencing rules, or 'drop' to remove them entirely.", + default => 'keep', + }; $class->register_method({ name => 'delete_ipset', @@ -166,6 +176,17 @@ sub register_delete_ipset { die "IPSet '$param->{name}' is not empty\n" if scalar(@$ipset) && !$param->{force}; + my $action = $param->{'dangling-references'} // 'keep'; + + update_refs({ + conf => $fw_conf, + kind => 'ipset', + old => $param->{name}, + env => $class->rule_env(), + action => $action eq 'keep' ? undef : $action, + subject => "ipset '$param->{name}' deleted", + }); + $class->save_ipset($param, $fw_conf, undef); }, -- 2.47.3