[PATCH pve-firewall v2 3/9] api: ipset: add option to GC references on delete

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

Deleting an ipset referenced by rules or security groups leaves dangling
references, which the firewall fails to parse and drops.

Add a 'delete-references' option to the delete endpoint to allow
removing such references. For cluster ipsets, this also covers all
downstream configs (host, guest and vnet).

Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
 src/PVE/API2/Firewall/IPSet.pm | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/PVE/API2/Firewall/IPSet.pm b/src/PVE/API2/Firewall/IPSet.pm
index 0d802aa..ba233b7 100644
--- a/src/PVE/API2/Firewall/IPSet.pm
+++ b/src/PVE/API2/Firewall/IPSet.pm
@@ -2,6 +2,7 @@ package PVE::API2::Firewall::IPSetBase;
 
 use strict;
 use warnings;
+use PVE::Firewall::Helpers qw(update_refs get_object_spec);
 use PVE::Exception qw(raise raise_param_exc);
 use PVE::JSONSchema qw(get_standard_option);
 
@@ -140,6 +141,12 @@ sub register_delete_ipset {
         optional => 1,
         description => 'Delete all members of the IPSet, if there are any.',
     };
+    $properties->{'delete-references'} = {
+        type => 'boolean',
+        optional => 1,
+        description => 'Delete dangling references after deleting the IPSet.',
+        default => 0,
+    };
 
     $class->register_method({
         name => 'delete_ipset',
@@ -166,6 +173,11 @@ sub register_delete_ipset {
                     die "IPSet '$param->{name}' is not empty\n"
                         if scalar(@$ipset) && !$param->{force};
 
+                    if ($param->{'delete-references'}) {
+                        my $spec = get_object_spec('ipset');
+                        update_refs($fw_conf, $spec, $param->{name}, undef, $class->rule_env());
+                    }
+
                     $class->save_ipset($param, $fw_conf, undef);
 
                 },
-- 
2.47.3