From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 013501FF15C for ; Wed, 8 Jan 2025 13:10:22 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 4EA3C18791; Wed, 8 Jan 2025 13:09:59 +0100 (CET) To: pve-devel@lists.proxmox.com Date: Wed, 8 Jan 2025 13:09:01 +0100 In-Reply-To: <20250108120903.5344-1-lou.lecrivain@wdz.de> References: <20250108120903.5344-1-lou.lecrivain@wdz.de> MIME-Version: 1.0 Message-ID: List-Id: Proxmox VE development discussion List-Post: From: Lou Lecrivain via pve-devel Precedence: list Cc: Lou Lecrivain X-Mailman-Version: 2.1.29 X-BeenThere: pve-devel@lists.proxmox.com List-Subscribe: , List-Unsubscribe: , List-Archive: Reply-To: Proxmox VE development discussion List-Help: Subject: [pve-devel] SPAM: [PATCH pve-network v2 5/7] ipam: nautobot: add checks for prefix deletion Content-Type: multipart/mixed; boundary="===============3678030004783005315==" Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" --===============3678030004783005315== Content-Type: message/rfc822 Content-Disposition: inline Return-Path: X-Original-To: pve-devel@lists.proxmox.com Delivered-To: pve-devel@lists.proxmox.com Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 81F92CB090 for ; Wed, 8 Jan 2025 13:09:57 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id B7FB118776 for ; Wed, 8 Jan 2025 13:09:56 +0100 (CET) Received: from smtp.smtpout.orange.fr (smtp-65.smtpout.orange.fr [80.12.242.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Wed, 8 Jan 2025 13:09:55 +0100 (CET) Received: from localhost ([176.139.8.107]) by smtp.orange.fr with ESMTPA id VUsbtmUcbPdSSVUsetMNKb; Wed, 08 Jan 2025 13:09:49 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=orange.fr; s=t20230301; t=1736338189; bh=HAvdkNvXhXXTQZNenCVb8qTtSrAgTfGZd54G2UVvN88=; h=From:To:Subject:Date:Message-Id:MIME-Version; b=HfDdkdaqKImJkkM+3TmD10KysLbZPASLevMo3ji8VSxO0XkeVZ99ZZtJYrVucTZEd 2ephtR+dx0YjWZKVzdWBE+W4/gx7iF1csgiJpwPDZwqRz9vUDLwX+xbnPpfSkbnotP xkToMRpYTU+3ENbQBfhacwFU8fLA3HSic0QLM1ONUGZX3Y6s7mP1HNVBPv0nDJ5hxu fzIrRUla782iue7PB0SDbooewDCOPnk1Jp8g7IYVqf0WJokNiXnwzGpqAeZqjqig01 OtQn2ZjEecurMp91JjCcOhvqFqOjREr2yKVipSsA8yNTkyfw2CDlwnvU39VBwZdENm yKCKXcvx472Wg== X-ME-Helo: localhost X-ME-Auth: bG91LmxlY3JpdmFpbkBvcmFuZ2UuZnI= X-ME-Date: Wed, 08 Jan 2025 13:09:49 +0100 X-ME-IP: 176.139.8.107 From: Lou Lecrivain To: pve-devel@lists.proxmox.com subject: SPAM: [PATCH pve-network v2 5/7] ipam: nautobot: add checks for prefix deletion Date: Wed, 8 Jan 2025 13:09:01 +0100 Message-Id: <20250108120903.5344-10-lou.lecrivain@wdz.de> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20250108120903.5344-1-lou.lecrivain@wdz.de> References: <20250108120903.5344-1-lou.lecrivain@wdz.de> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 4 AWL -0.074 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_REJECT 0.1 DMARC reject policy FREEMAIL_FORGED_FROMDOMAIN 0.001 2nd level domains in From and EnvelopeFrom freemail headers are different FREEMAIL_FROM 0.001 Sender email is commonly abused enduser mail provider HEADER_FROM_DIFFERENT_DOMAINS 0.24 From and EnvelopeFrom 2nd level mail domains are different KAM_DMARC_REJECT 6 DKIM has Failed or SPF has failed on the message and the domain has a DMARC reject policy RCVD_IN_DNSWL_NONE -0.0001 Sender listed at https://www.dnswl.org/, no trust RCVD_IN_MSPIKE_H4 0.001 Very Good reputation (+4) RCVD_IN_MSPIKE_WL 0.001 Mailspike good senders SPF_HELO_PASS -0.001 SPF: HELO matches SPF record SPF_PASS -0.001 SPF: sender matches SPF record check that prefix/subnet is empty (only gateway IPs should remain) before deletion. Signed-off-by: lou lecrivain --- src/PVE/Network/SDN/Ipams/NautobotPlugin.pm | 60 ++++++++++++++++++++- 1 file changed, 58 insertions(+), 2 deletions(-) diff --git a/src/PVE/Network/SDN/Ipams/NautobotPlugin.pm b/src/PVE/Network/SDN/Ipams/NautobotPlugin.pm index 79ac04d..f736bad 100644 --- a/src/PVE/Network/SDN/Ipams/NautobotPlugin.pm +++ b/src/PVE/Network/SDN/Ipams/NautobotPlugin.pm @@ -5,6 +5,7 @@ use warnings; use PVE::INotify; use PVE::Cluster; use PVE::Tools; +use List::Util qw(all); use NetAddr::IP; use base('PVE::Network::SDN::Ipams::Plugin'); @@ -76,8 +77,11 @@ sub del_subnet { my $internalid = get_prefix_id($url, $cidr, $headers, $noerr); return if !$internalid; - # TODO check that prefix is empty before deletion - return; + if (!subnet_is_deletable($class, $plugin_config, $subnetid, $subnet, $internalid, $noerr)) { + die "cannot delete prefix $cidr, not empty!"; + } + + empty_subnet($class, $plugin_config, $subnetid, $subnet, $internalid, $noerr); eval { PVE::Network::SDN::api_request("DELETE", "$url/ipam/prefixes/$internalid/", $headers); @@ -227,6 +231,58 @@ sub del_ip { } } +sub empty_subnet { + my ($class, $plugin_config, $subnetid, $subnet, $subnetuuid, $noerr) = @_; + + my $url = $plugin_config->{url}; + my $namespace = $plugin_config->{namespace}; + my $headers = default_headers($plugin_config); + + my $response = eval { + return PVE::Network::SDN::api_request("GET", "$url/ipam/ip-addresses/?namespace=$namespace&parent=$subnetuuid", $headers) + }; + if ($@) { + die "error querying prefix $subnet: $@" if !$noerr; + } + + for my $ip (@{$response->{results}}) { + del_ip($class, $plugin_config, $subnetid, $subnet, $ip->{host}, $noerr); + } +} + +sub subnet_is_deletable { + my ($class, $plugin_config, $subnetid, $subnet, $subnetuuid, $noerr) = @_; + + my $url = $plugin_config->{url}; + my $namespace = $plugin_config->{namespace}; + my $headers = default_headers($plugin_config); + + + my $response = eval { + return PVE::Network::SDN::api_request("GET", "$url/ipam/ip-addresses/?namespace=$namespace&parent=$subnetuuid", $headers) + }; + if ($@) { + die "error querying prefix $subnet: $@" if !$noerr; + } + my $n_ips = scalar $response->{results}->@*; + + # least costly check operation 1st + if ($n_ips == 0) { + # completely empty, delete ok + return 1; + } elsif ( + !(all {$_ == 1} ( + map { + is_ip_gateway($url, $_->{host}, $headers, $noerr) + } $response->{results}->@* + ))) { + # some remaining IPs are not gateway, nok + return 0; + } else { + # remaining IPs are all gateway, delete ok + return 1; + } +} sub verify_api { my ($class, $plugin_config) = @_; -- 2.39.5 --===============3678030004783005315== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel --===============3678030004783005315==--