configs: warn about duplicate ipset entries

instead of silently dropping them when writing the config out.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index c34216758acfffdcd020c707521ac6bd0b26a468..e349ee7769a6d529a3414075bf04520085e31d06 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -2897,6 +2897,8 @@ sub generic_fw_config_parser {
     }
     return {} if !$raw;
 
     }
     return {} if !$raw;
 

+    my $curr_group_keys = {};
+

     my $linenr = 0;
     while ($raw =~ /^\h*(.*?)\h*$/gm) {
        my $line = $1;
     my $linenr = 0;
     while ($raw =~ /^\h*(.*?)\h*$/gm) {
        my $line = $1;


@@ -2957,6 +2959,8 @@ sub generic_fw_config_parser {
            }
 
            $res->{$section}->{$group} = [];
            }
 
            $res->{$section}->{$group} = [];

+           $curr_group_keys = {};
+

            $res->{ipset_comments}->{$group} = decode('utf8', $comment)
                if $comment;
            next;
            $res->{ipset_comments}->{$group} = decode('utf8', $comment)
                if $comment;
            next;


@@ -3021,6 +3025,8 @@ sub generic_fw_config_parser {
                } else {
                    $cidr = parse_ip_or_cidr($cidr);
                }
                } else {
                    $cidr = parse_ip_or_cidr($cidr);
                }

+               die "duplicate ipset entry for '$cidr'\n"
+                   if defined($curr_group_keys->{$cidr});

            };
            if (my $err = $@) {
                chomp $err;
            };
            if (my $err = $@) {
                chomp $err;


@@ -3044,6 +3050,7 @@ sub generic_fw_config_parser {
            }
 
            push @{$res->{$section}->{$group}}, $entry;
            }
 
            push @{$res->{$section}->{$group}}, $entry;

+           $curr_group_keys->{$cidr} = 1;

        } else {
            warn "$prefix: skip line - unknown section\n";
            next;
        } else {
            warn "$prefix: skip line - unknown section\n";
            next;


@@ -3221,7 +3228,13 @@ my $format_ipsets = sub {
 
        my $nethash = {};
        foreach my $entry (@$options) {
 
        my $nethash = {};
        foreach my $entry (@$options) {

-           $nethash->{$entry->{cidr}} = $entry;
+           my $cidr = $entry->{cidr};
+           if (defined($nethash->{$cidr})) {
+               warn "ignoring duplicate ipset entry '$cidr'\n";
+               next;
+           }
+
+           $nethash->{$cidr} = $entry;

        }
 
        foreach my $cidr (sort keys %$nethash) {
        }
 
        foreach my $cidr (sort keys %$nethash) {