[pve-devel] applied: [PATCH firewall] parser: fix scoped alias resolution

[Wolfgang Bumiller]

applied & bumped, thanks

On Tue, Jul 11, 2023 at 11:41:15AM +0200, Leo Nunner wrote:
> We tried to resolve aliases in some places where the cluster
> configuration didn't get set. It's probably better to handle these cases
> directly in the function at hand, instead of at every place where this
> issues might arise.
> 
> This seemingly fixes the issues reported on pve-user and the forum:
>   * https://forum.proxmox.com/threads/pve-8-pve-firewall-status-no-such-alias.130202/
>   * https://forum.proxmox.com/threads/ipset-not-working-for-accepting-cluster-traffic.129599/
> 
> Signed-off-by: Leo Nunner <l.nunner at proxmox.com>
> ---
>  src/PVE/API2/Firewall/IPSet.pm |  2 --
>  src/PVE/Firewall.pm            | 18 ++++++++++++++----
>  2 files changed, 14 insertions(+), 6 deletions(-)
> 
> diff --git a/src/PVE/API2/Firewall/IPSet.pm b/src/PVE/API2/Firewall/IPSet.pm
> index baa57ca..ed92d87 100644
> --- a/src/PVE/API2/Firewall/IPSet.pm
> +++ b/src/PVE/API2/Firewall/IPSet.pm
> @@ -203,8 +203,6 @@ sub register_create_ip {
>  		if ($cidr =~ m@^(dc/|guest/)?(${PVE::Firewall::ip_alias_pattern})$@) {
>  		    my $scope = $1 // "";
>  		    my $alias = $2;
> -		    # on the cluster level
> -		    $cluster_conf = $fw_conf if (!$cluster_conf);
>  		    # make sure alias exists (if $cidr is an alias)
>  		    PVE::Firewall::resolve_alias($cluster_conf, $fw_conf, $alias, $scope);
>  		} else {
> diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
> index 9bed8df..77cbaf4 100644
> --- a/src/PVE/Firewall.pm
> +++ b/src/PVE/Firewall.pm
> @@ -2979,13 +2979,23 @@ sub parse_clusterfw_option {
>  sub resolve_alias {
>      my ($clusterfw_conf, $fw_conf, $cidr, $scope) = @_;
>  
> +    # When we're on the cluster level, the cluster config only gets
> +    # saved into fw_conf, so we need some extra handling here (to
> +    # stay consistent)
> +    my ($cluster_config, $local_config);
> +    if (!$clusterfw_conf) {
> +	($cluster_config, $local_config) = ($fw_conf, undef);
> +    } else {
> +	($cluster_config, $local_config) = ($clusterfw_conf, $fw_conf);
> +    }
> +
>      my $alias = lc($cidr);
>      my $e;
> -    if ($scope ne 'dc/' && $fw_conf) {
> -	$e = $fw_conf->{aliases}->{$alias};
> +    if ($scope ne 'dc/' && $local_config) {
> +	$e = $local_config->{aliases}->{$alias};
>      }
> -    if ($scope ne 'guest/' && !$e && $clusterfw_conf) {
> -	$e = $clusterfw_conf->{aliases}->{$alias};
> +    if ($scope ne 'guest/' && !$e && $cluster_config) {
> +	$e = $cluster_config->{aliases}->{$alias};
>      }
>  
>      die "no such alias '$cidr'\n" if !$e;;
> -- 
> 2.39.2