From 1f0303f82a7d661024a374ab2cf195835390b738 Mon Sep 17 00:00:00 2001 From: Leo Nunner Date: Tue, 11 Jul 2023 11:41:15 +0200 Subject: [PATCH] parser: fix scoped alias resolution We tried to resolve aliases in some places where the cluster configuration didn't get set. It's probably better to handle these cases directly in the function at hand, instead of at every place where this issues might arise. This seemingly fixes the issues reported on pve-user and the forum: * https://forum.proxmox.com/threads/pve-8-pve-firewall-status-no-such-alias.130202/ * https://forum.proxmox.com/threads/ipset-not-working-for-accepting-cluster-traffic.129599/ Signed-off-by: Leo Nunner --- src/PVE/API2/Firewall/IPSet.pm | 2 -- src/PVE/Firewall.pm | 18 ++++++++++++++---- 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/src/PVE/API2/Firewall/IPSet.pm b/src/PVE/API2/Firewall/IPSet.pm index baa57ca..ed92d87 100644 --- a/src/PVE/API2/Firewall/IPSet.pm +++ b/src/PVE/API2/Firewall/IPSet.pm @@ -203,8 +203,6 @@ sub register_create_ip { if ($cidr =~ m@^(dc/|guest/)?(${PVE::Firewall::ip_alias_pattern})$@) { my $scope = $1 // ""; my $alias = $2; - # on the cluster level - $cluster_conf = $fw_conf if (!$cluster_conf); # make sure alias exists (if $cidr is an alias) PVE::Firewall::resolve_alias($cluster_conf, $fw_conf, $alias, $scope); } else { diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index 9bed8df..77cbaf4 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -2979,13 +2979,23 @@ sub parse_clusterfw_option { sub resolve_alias { my ($clusterfw_conf, $fw_conf, $cidr, $scope) = @_; + # When we're on the cluster level, the cluster config only gets + # saved into fw_conf, so we need some extra handling here (to + # stay consistent) + my ($cluster_config, $local_config); + if (!$clusterfw_conf) { + ($cluster_config, $local_config) = ($fw_conf, undef); + } else { + ($cluster_config, $local_config) = ($clusterfw_conf, $fw_conf); + } + my $alias = lc($cidr); my $e; - if ($scope ne 'dc/' && $fw_conf) { - $e = $fw_conf->{aliases}->{$alias}; + if ($scope ne 'dc/' && $local_config) { + $e = $local_config->{aliases}->{$alias}; } - if ($scope ne 'guest/' && !$e && $clusterfw_conf) { - $e = $clusterfw_conf->{aliases}->{$alias}; + if ($scope ne 'guest/' && !$e && $cluster_config) { + $e = $cluster_config->{aliases}->{$alias}; } die "no such alias '$cidr'\n" if !$e;; -- 2.39.5