SPAM: [PATCH pve-network v3 08/16] apply: add option to handle dangling references on VNet deletion

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

For each VNet, 4 IPSets are auto-generated (<vnet>-all, -gateway,
-no-gateway and -dhcp) [0]. Therefore, deleting a VNet can lead to
rules referencing non-existing IPSets, which the firewall fails to
parse and ignores.

Add a 'dangling-ipset-references' option for PUT /cluster/sdn allowing
to 'drop' rules referencing now-deleted IPSets, 'disable' them, or
'keep' them as they are.

[0] https://pve.proxmox.com/wiki/Software-Defined_Network#pvesdn_firewall_integration

Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
 src/PVE/API2/Network/SDN.pm | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/src/PVE/API2/Network/SDN.pm b/src/PVE/API2/Network/SDN.pm
index e3c8d9d..e304299 100644
--- a/src/PVE/API2/Network/SDN.pm
+++ b/src/PVE/API2/Network/SDN.pm
@@ -8,6 +8,8 @@ use JSON qw(from_json);
 
 use PVE::Cluster qw(cfs_lock_file cfs_read_file cfs_write_file);
 use PVE::Exception qw(raise_param_exc);
+use PVE::Firewall;
+use PVE::Firewall::Helpers;
 use PVE::JSONSchema qw(get_standard_option);
 use PVE::RESTHandler;
 use PVE::RPCEnvironment;
@@ -302,6 +304,18 @@ __PACKAGE__->register_method({
                 description =>
                     'When lock-token has been provided and configuration successfully committed, release the lock automatically afterwards',
             },
+            'dangling-ipset-references' => {
+                type => 'string',
+                enum => ['keep', 'disable', 'drop'],
+                optional => 1,
+                default => 'keep',
+                description =>
+                    'If the applied SDN changes delete one or more VNets, handle the firewall '
+                    . 'rules referencing their auto-generated IPSets. Use \'disable\' to disable '
+                    . 'those rules, or \'drop\' to remove them entirely. Kept as they are, they '
+                    . 'reference an IPSet that no longer exists and are dropped from the '
+                    . 'generated ruleset.',
+            },
         },
     },
     returns => {
@@ -315,6 +329,7 @@ __PACKAGE__->register_method({
 
         my $lock_token = extract_param($param, 'lock-token');
         my $release_lock = extract_param($param, 'release-lock');
+        my $dangling_refs = extract_param($param, 'dangling-ipset-references') // 'keep';
 
         my $previous_config_has_frr;
         my $new_config_has_frr;
@@ -322,6 +337,23 @@ __PACKAGE__->register_method({
         PVE::Network::SDN::lock_sdn_config(
             sub {
                 $previous_config_has_frr = PVE::Network::SDN::running_config_has_frr();
+
+                if ($dangling_refs ne 'keep') {
+                    my $running = PVE::Network::SDN::running_config() // {};
+                    my $vnets = PVE::Network::SDN::Vnets::config() // {};
+                    my $removed =
+                        [grep { !$vnets->{ids}->{$_} } keys $running->{vnets}->{ids}->%*];
+
+                    if ($removed->@*) {
+                        eval {
+                            PVE::Firewall::Helpers::update_vnet_ipset_refs(
+                                $removed, $dangling_refs,
+                            );
+                        };
+                        warn "could not update references to VNet IPSets: $@" if $@;
+                    }
+                }
+
                 PVE::Network::SDN::commit_config();
                 $new_config_has_frr = PVE::Network::SDN::running_config_has_frr();
 
-- 
2.47.3