From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id E67791FF0B3 for ; Wed, 11 Nov 2026 14:19:42 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 58056216DA; Wed, 11 Nov 2026 14:19:17 +0100 (CET) From: Arthur Bied-Charreton To: pve-devel@lists.proxmox.com Subject: [PATCH pve-firewall v6 06/28] firewall: parser: do not log errors for disabled rules Date: Wed, 11 Nov 2026 14:18:39 +0100 Message-ID: <20261111131901.1791124-7-a.bied-charreton@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261111131901.1791124-1-a.bied-charreton@proxmox.com> References: <20261111131901.1791124-1-a.bied-charreton@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1794403148117 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.661 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: F3M4W5L36MP424PAIY2MJV347MK225J7 X-Message-ID-Hash: F3M4W5L36MP424PAIY2MJV347MK225J7 X-MailFrom: a.bied-charreton@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The rule parser always logged errors when encountering them, even if the offending rule was disabled. The following commits add functionality to automatically disable rules with dangling references to ipsets or aliases. Avoid logging errors for disabled rules since that will then become an expected state. Signed-off-by: Arthur Bied-Charreton --- src/PVE/Firewall.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index 4631b5a..6ce5306 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -3417,7 +3417,7 @@ sub parse_fw_rule { die "unable to parse rule parameters: $line\n" if length($line); $rule = verify_rule($rule, $cluster_conf, $fw_conf, $rule_env, 1); - if ($rule->{errors}) { + if ($rule->{enable} && $rule->{errors}) { # The verbose flag really means we're running from the CLI and want # output on the console - in the other case we really want such errors # to go into the syslog instead. -- 2.47.3