[PATCH pve-firewall v3 05/16] api: aliases: add option to update references on edit

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

Renaming an alias still referenced by rules or ipset members leaves
dangling references. The firewall then fails to parse those rules
during compilation and drops them. The errors, while logged to the
journal, are not visible from the GUI - a rename can therefore
effectively disable a whole set of rules.

Add an 'update-references' option to the rename path to rewrite them to
the new name. For cluster aliases, this also covers references in
downstream configs (host, guest and vnet).

The new alias is persisted before its references are rewritten, so a
concurrent firewall compilation never observes a dangling reference. If
the cluster-wide rewrite is interrupted, it can be retried by passing
'update-references=force'.

Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
 src/PVE/API2/Firewall/Aliases.pm | 39 +++++++++++++++++++++++++++++---
 1 file changed, 36 insertions(+), 3 deletions(-)

diff --git a/src/PVE/API2/Firewall/Aliases.pm b/src/PVE/API2/Firewall/Aliases.pm
index 4f6960d..b5bad48 100644
--- a/src/PVE/API2/Firewall/Aliases.pm
+++ b/src/PVE/API2/Firewall/Aliases.pm
@@ -2,6 +2,8 @@ package PVE::API2::Firewall::AliasesBase;
 
 use strict;
 use warnings;
+
+use PVE::Firewall::Helpers qw(update_refs get_object_spec);
 use PVE::Exception qw(raise raise_param_exc);
 use PVE::JSONSchema qw(get_standard_option);
 
@@ -219,6 +221,16 @@ sub register_update_alias {
     $properties->{comment} = $api_properties->{comment};
     $properties->{digest} = get_standard_option('pve-config-digest');
 
+    $properties->{'update-references'} = {
+        type => 'string',
+        enum => ['no', 'yes', 'force'],
+        optional => 1,
+        description =>
+            "Update all references to the alias when renaming it. Use 'force' to also "
+            . "overwrite an existing target alias, e.g. to resume an interrupted rename.",
+        default => 'no',
+    };
+
     $class->register_method({
         name => 'update_alias',
         path => '{name}',
@@ -239,6 +251,8 @@ sub register_update_alias {
                 sub {
                     my ($param) = @_;
 
+                    my $update_references = $param->{'update-references'} // 'no';
+
                     my ($fw_conf, $aliases) = $class->load_config($param);
 
                     my $list = &$aliases_to_list($aliases);
@@ -261,9 +275,28 @@ sub register_update_alias {
 
                     if ($rename && ($name ne $rename)) {
                         raise_param_exc({ name => "alias '$param->{rename}' already exists" })
-                            if defined($aliases->{$rename});
-                        $aliases->{$name}->{name} = $param->{rename};
-                        $aliases->{$rename} = $aliases->{$name};
+                            if defined($aliases->{$rename})
+                            && $update_references ne 'force';
+
+                        $aliases->{$rename} =
+                            { $aliases->{$name}->%*, name => $param->{rename} };
+
+                        if ($update_references ne 'no') {
+                            my $env = $class->rule_env();
+                            my $spec = get_object_spec('aliases');
+                            my $new_name = $param->{rename};
+
+                            # persist the new alias before rewriting references so a concurrent
+                            # compilation never sees a reference to a not-yet-saved alias.
+                            $class->save_aliases($param, $fw_conf, $aliases)
+                                if $env eq 'cluster';
+
+                            eval { update_refs($fw_conf, $spec, $name, $new_name, $env) };
+                            die "rename interrupted, references may be partially updated; "
+                                . "retry with 'force' to finish: $@"
+                                if $@;
+                        }
+
                         delete $aliases->{$name};
                     }
 
-- 
2.47.3