[PATCH pve-network v5 15/27] apply: add option to handle dangling references on VNet deletion

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

For each VNet, 4 IPSets are auto-generated (<vnet>-all, -gateway,
-no-gateway and -dhcp) [0]. Therefore, deleting a VNet can lead to
rules referencing non-existing IPSets, which the firewall fails to
parse and ignores.

Add a 'dangling-ipset-references' option for PUT /cluster/sdn allowing
to 'drop' rules referencing now-deleted IPSets, 'disable' them, or
'keep' them as they are.

[0] https://pve.proxmox.com/wiki/Software-Defined_Network#pvesdn_firewall_integration

Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
 src/PVE/API2/Network/SDN.pm | 38 +++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/src/PVE/API2/Network/SDN.pm b/src/PVE/API2/Network/SDN.pm
index e3c8d9d..88d9d78 100644
--- a/src/PVE/API2/Network/SDN.pm
+++ b/src/PVE/API2/Network/SDN.pm
@@ -8,6 +8,8 @@ use JSON qw(from_json);
 
 use PVE::Cluster qw(cfs_lock_file cfs_read_file cfs_write_file);
 use PVE::Exception qw(raise_param_exc);
+use PVE::Firewall;
+use PVE::Firewall::References;
 use PVE::JSONSchema qw(get_standard_option);
 use PVE::RESTHandler;
 use PVE::RPCEnvironment;
@@ -302,6 +304,16 @@ __PACKAGE__->register_method({
                 description =>
                     'When lock-token has been provided and configuration successfully committed, release the lock automatically afterwards',
             },
+            'dangling-ipset-references' => {
+                type => 'string',
+                enum => ['keep', 'disable', 'drop'],
+                optional => 1,
+                default => 'keep',
+                description =>
+                    'If the applied SDN changes delete one or more VNets, handle the firewall '
+                    . 'rules referencing their auto-generated IPSets. Use \'disable\' to disable '
+                    . 'those rules, or \'drop\' to remove them entirely.',
+            },
         },
     },
     returns => {
@@ -315,13 +327,35 @@ __PACKAGE__->register_method({
 
         my $lock_token = extract_param($param, 'lock-token');
         my $release_lock = extract_param($param, 'release-lock');
+        my $dangling_refs = extract_param($param, 'dangling-ipset-references') // 'keep';
 
         my $previous_config_has_frr;
         my $new_config_has_frr;
 
+        my $ref_log = [];
+
         PVE::Network::SDN::lock_sdn_config(
             sub {
                 $previous_config_has_frr = PVE::Network::SDN::running_config_has_frr();
+
+                if ($dangling_refs ne 'keep') {
+                    my $running = PVE::Network::SDN::running_config() // {};
+                    my $vnets = PVE::Network::SDN::Vnets::config() // {};
+                    my $removed =
+                        [grep { !$vnets->{ids}->{$_} } keys $running->{vnets}->{ids}->%*];
+
+                    if ($removed->@*) {
+                        eval {
+                            PVE::Firewall::References::update_vnet_ipset_refs(
+                                $removed,
+                                $dangling_refs,
+                                sub { push $ref_log->@*, $_[0] },
+                            );
+                        };
+                        warn "could not update references to VNet IPSets: $@" if $@;
+                    }
+                }
+
                 PVE::Network::SDN::commit_config();
                 $new_config_has_frr = PVE::Network::SDN::running_config_has_frr();
 
@@ -336,6 +370,10 @@ __PACKAGE__->register_method({
         my $regenerate_frr = ($previous_config_has_frr || $new_config_has_frr) ? 1 : 0;
 
         my $code = sub {
+            # the rewrite has to happen under the SDN lock and before the config is committed,
+            # which is before there is a task, so the record is only logged here.
+            print("$_\n") for $ref_log->@*;
+
             $rpcenv->{type} = 'priv'; # to start tasks in background
             PVE::Cluster::check_cfs_quorum();
             my $nodelist = PVE::Cluster::get_nodelist();
-- 
2.47.3