From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id 2852D1FF146 for ; Tue, 09 Jun 2026 12:08:04 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 5B8A9BB0F; Tue, 9 Jun 2026 12:08:02 +0200 (CEST) Message-ID: Date: Tue, 9 Jun 2026 12:07:56 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Beta Subject: Re: [PATCH access-control/network v3 0/5] fix #7520: sdn: prune orphaned ACLs and handle VNet migrations To: David Riley , pve-devel@lists.proxmox.com References: <20260603145523.120075-1-d.riley@proxmox.com> Content-Language: en-US From: Jakob Klocker In-Reply-To: <20260603145523.120075-1-d.riley@proxmox.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1780999631851 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.983 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: AXGAEV26RRONV7N4SU6LAXSIYZRJ7HYO X-Message-ID-Hash: AXGAEV26RRONV7N4SU6LAXSIYZRJ7HYO X-MailFrom: j.klocker@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: I reproduced the orphaned ACL entry problem for: * Zones (Simple, VLAN, QinQ, VXLAN, EVPN) * VNets * Controllers * Fabrics * Route Maps * Prefix Lists The patch fixes this for me. After removing any of the above, the corresponding ACL entry is now deleted as well. I also tested whether moving a VNet between zones adapts the permissions. Before the patch it didn't, after the patch it does. That said, I'd question whether blindly moving and removing permissions is the expected behaviour, since permissions can be created for SDN paths that don't actually exist yet. Maybe a checkbox controlling whether the permissions should be deleted/moved/copied would be the way to go here. One unrelated thing I noticed while testing: when removing a VNet, the associated firewall config isn't deleted. This could cause problems if a new VNet with the same name is created later, since it would pick up the stale config. Tested-by: Jakob Klocker On 6/3/26 4:55 PM, David Riley wrote: > Implement a pruning mechanism to clean up orphaned SDN ACL entries by > comparing the running configuration with the newly compiled state > during configuration commit. > > This ensures state consistency for manual applies via the UI/API > as well as during the automatic configuration reload on system boot. > The pruning covers: > * Zones > * VNets > * Fabrics > * Controllers > * Route maps > * Prefix lists > > IPAMs and DNS are excluded as they are not staged. > > Difference from v2: > * Relocate VNet ACLs to the new zone path when a VNet is moved, > including a validation check to abort on path conflicts. > * Refactor diff generation in preparation for an upcoming patch > series, resolving #7294 [0]. The upcoming series will hook into the > VNet diff to clean up pool members. > * Add unit testing for pruning and migration mechanism > > Link: https://bugzilla.proxmox.com/show_bug.cgi?id=7520 > > [0] https://bugzilla.proxmox.com/show_bug.cgi?id=7294 > > > pve-access-control: > > David Riley (4): > fix: #7520: sdn: prune orphaned ACLs on resource deletion > fix #7520: test: add unit tests for sdn acl pruning logic > fix: #7520: sdn: add VNet ACL migration > fix #7520: test: add unit tests for sdn acl migration logic > > src/PVE/AccessControl.pm | 132 +++++++++++++++++++++++++++++ > src/test/Makefile | 3 + > src/test/sdn_acl_migration.cfg | 13 +++ > src/test/sdn_acl_migration_test.pl | 118 ++++++++++++++++++++++++++ > src/test/sdn_acl_pruning.cfg | 22 +++++ > src/test/sdn_acl_pruning_test.pl | 116 +++++++++++++++++++++++++ > 6 files changed, 404 insertions(+) > create mode 100644 src/test/sdn_acl_migration.cfg > create mode 100644 src/test/sdn_acl_migration_test.pl > create mode 100644 src/test/sdn_acl_pruning.cfg > create mode 100644 src/test/sdn_acl_pruning_test.pl > > > pve-network: > > David Riley (1): > fix #7520: config: prune orphaned ACLs and relocate moved VNets > > src/PVE/Network/SDN.pm | 123 +++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 123 insertions(+) > > > Summary over all repositories: > 7 files changed, 527 insertions(+), 0 deletions(-) >