[pve-devel] [PATCH pve-network 2/2] Create a cluster-wide firewall for SDN subnets

[Stefan Lendl <s.lendl@proxmox.com>]

Upon creation of a subnet, we create a cluster-wide firewall alias.

Signed-off-by: Stefan Lendl <s.lendl@proxmox.com>
---

Notes:
    Creates the alias directly when the Subnet is created.
    
    Other SDN objects are created upon 'Apply': commit_config().
    Although, IPAM creates the subnet right away as well.
    This should not be an issue but is inconsistent.

 src/PVE/Network/SDN/Subnets.pm | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/PVE/Network/SDN/Subnets.pm b/src/PVE/Network/SDN/Subnets.pm
index 6bb42e5..fe67abd 100644
--- a/src/PVE/Network/SDN/Subnets.pm
+++ b/src/PVE/Network/SDN/Subnets.pm
@@ -6,6 +6,7 @@ use warnings;
 use Net::Subnet qw(subnet_matcher);
 use Net::IP;
 use NetAddr::IP qw(:lower);
+use PVE::API2::Firewall::Aliases;
 
 use PVE::Cluster qw(cfs_read_file cfs_write_file cfs_lock_file);
 use PVE::Network::SDN::Dns;
@@ -161,6 +162,13 @@ sub del_dns_ptr_record {
     $plugin->del_ptr_record($plugin_config, $reversezone, $ip);
 }
 
+sub get_fw_alias_name {
+    my ($subnet) = @_;
+    my $cidr = $subnet->{cidr};
+    $cidr =~ tr/.\//-/;
+    return "$subnet->{zone}_$subnet->{vnet}_$cidr";
+}
+
 sub add_subnet {
     my ($zone, $subnetid, $subnet) = @_;
 
@@ -170,6 +178,13 @@ sub add_subnet {
     my $plugin_config = $ipam_cfg->{ids}->{$ipam};
     my $plugin = PVE::Network::SDN::Ipams::Plugin->lookup($plugin_config->{type});
     $plugin->add_subnet($plugin_config, $subnetid, $subnet);
+
+    my $param = {
+	name => get_fw_alias_name($subnet),
+	cidr => $subnet->{cidr},
+	comment => "Automatically created Alias from SDN => Zone: $subnet->{zone}, VNet: $subnet->{vnet}, Subnet: $subnet->{cidr}"
+    };
+    PVE::API2::Firewall::ClusterAliases->create_alias($param);
 }
 
 sub del_subnet {
@@ -181,6 +196,9 @@ sub del_subnet {
     my $plugin_config = $ipam_cfg->{ids}->{$ipam};
     my $plugin = PVE::Network::SDN::Ipams::Plugin->lookup($plugin_config->{type});
     $plugin->del_subnet($plugin_config, $subnetid, $subnet);
+
+    my $param = { name => get_fw_alias_name($subnet) };
+    PVE::API2::Firewall::ClusterAliases->remove_alias($param);
 }
 
 sub next_free_ip {
-- 
2.41.0