SPAM: [PATCH pve-container v3 10/16] api: destroy_vm: add option to handle dangling IPSet references

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

For each guest with IPAM entries, a 'guest-ipam-<vmid>' IPSet is
auto-generated [0]. Therefore, deleting a guest can lead to firewall
rules referencing non-existing IPSets, which the firewall fails to
parse and ignores.

Add a 'dangling-ipset-references' option for DELETE
/nodes/{node}/lxc/{vmid} allowing to 'drop' rules referencing
now-deleted IPSets, to 'disable' them, or to 'keep' them as they are.

[0] https://pve.proxmox.com/wiki/Software-Defined_Network#pvesdn_firewall_integration

Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
 src/PVE/API2/LXC.pm | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/src/PVE/API2/LXC.pm b/src/PVE/API2/LXC.pm
index 5f94d5a..ac0bbce 100644
--- a/src/PVE/API2/LXC.pm
+++ b/src/PVE/API2/LXC.pm
@@ -845,6 +845,16 @@ __PACKAGE__->register_method({
                     . " enabled storages which are not referenced in the config.",
                 optional => 1,
             },
+            'dangling-ipset-references' => {
+                type => 'string',
+                enum => ['keep', 'disable', 'drop'],
+                optional => 1,
+                default => 'keep',
+                description => 'Handle firewall rules referencing the IPSet auto-generated for '
+                    . 'this guest (\'guest-ipam-<vmid>\'). Use \'disable\' to disable them, or '
+                    . '\'drop\' to remove them entirely. Kept as they are, they reference an IPSet '
+                    . 'that no longer exists and are dropped from the generated ruleset.',
+            },
         },
     },
     returns => {
@@ -922,6 +932,12 @@ __PACKAGE__->register_method({
                 }
             }
 
+            my $action = $param->{'dangling-ipset-references'} // 'keep';
+            if ($action ne 'keep') {
+                eval { PVE::Firewall::Helpers::update_guest_ipam_ipset_refs($vmid, $action); };
+                warn "could not $action dangling IPSet references: $@" if $@;
+            }
+
             # only now remove the zombie config, else we can have reuse race
             PVE::LXC::Config->destroy_config($vmid);
         };
-- 
2.47.3