[PATCH proxmox-perl-rs v4 18/45] pve-rs: sdn: microseg: bind the data plane

[Hannes Laimer <h.laimer@proxmox.com>]

Expose the policy lock to Perl, with the full apply of the running
config and the apply for one guest NIC at plug time as its methods.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 pve-rs/Cargo.toml                   |   2 +
 pve-rs/Makefile                     |   2 +
 pve-rs/debian/control               |   1 +
 pve-rs/src/bindings/sdn/microseg.rs | 108 ++++++++++++++++++++++++++++
 4 files changed, 113 insertions(+)

diff --git a/pve-rs/Cargo.toml b/pve-rs/Cargo.toml
index ecedb1ebe747..1b3e008323b1 100644
--- a/pve-rs/Cargo.toml
+++ b/pve-rs/Cargo.toml
@@ -38,6 +38,7 @@ proxmox-frr = { version = "0.6.0" }
 proxmox-http = { version = "1.0.2", features = ["client-sync", "client-trait"] }
 proxmox-http-error = "1"
 proxmox-log = "1"
+proxmox-microseg = "0.1"
 proxmox-network-types = "1.1.2"
 proxmox-notify = { version = "2", features = ["pve-context", "legacy-matchers"] }
 proxmox-oci = "0.2.2"
@@ -80,6 +81,7 @@ proxmox-wireguard = { version = "0.1.2" }
 # proxmox-log = { path = "../../proxmox/proxmox-log" }
 # proxmox-login = { path = "../../proxmox/proxmox-login" }
 # proxmox-metrics = { path = "../../proxmox/proxmox-metrics" }
+# proxmox-microseg = { path = "../../proxmox-ve-rs/proxmox-microseg" }
 # proxmox-network-api = { path = "../../proxmox/proxmox-network-api" }
 # proxmox-network-types = { path = "../../proxmox/proxmox-network-types" }
 # proxmox-notify = { path = "../../proxmox/proxmox-notify" }
diff --git a/pve-rs/Makefile b/pve-rs/Makefile
index df65dd994794..513cb29755db 100644
--- a/pve-rs/Makefile
+++ b/pve-rs/Makefile
@@ -35,6 +35,8 @@ PERLMOD_PACKAGES := \
 	  PVE::RS::ResourceScheduling::Dynamic \
 	  PVE::RS::SDN::Fabrics \
 	  PVE::RS::SDN::Microseg \
+	  PVE::RS::SDN::Microseg::ExclusiveLock \
+	  PVE::RS::SDN::Microseg::SharedLock \
 	  PVE::RS::SDN::PrefixLists \
 	  PVE::RS::SDN::RouteMaps \
 	  PVE::RS::SDN::WireGuard::PrivateKeys \
diff --git a/pve-rs/debian/control b/pve-rs/debian/control
index ad8611eb1b69..296fc7f05e42 100644
--- a/pve-rs/debian/control
+++ b/pve-rs/debian/control
@@ -26,6 +26,7 @@ Build-Depends: debhelper-compat (= 13),
                librust-proxmox-http-1+default-dev (>= 1.0.2-~~),
                librust-proxmox-http-error-1+default-dev,
                librust-proxmox-log-1+default-dev,
+               librust-proxmox-microseg-0.1+default-dev,
                librust-proxmox-network-types-1+default-dev (>= 1.1.2-~~),
                librust-proxmox-notify-2+default-dev,
                librust-proxmox-notify-2+legacy-matchers-dev,
diff --git a/pve-rs/src/bindings/sdn/microseg.rs b/pve-rs/src/bindings/sdn/microseg.rs
index a3a04b7dad1f..69173b3a662a 100644
--- a/pve-rs/src/bindings/sdn/microseg.rs
+++ b/pve-rs/src/bindings/sdn/microseg.rs
@@ -251,4 +251,112 @@ pub mod pve_rs_sdn_microseg {
     pub fn delete(#[try_from_ref] this: &PerlMicrosegConfig, id: &str) -> Result<(), Error> {
         change(this, |entries| microseg::api::delete(entries, id))
     }
+
+    pub(super) fn running_config_from(
+        raw: Option<&[u8]>,
+    ) -> Result<Option<MicrosegRunningConfig>, Error> {
+        match raw {
+            // pmxcfs yields the empty string for a zero-length file and the Perl reader of the
+            // same file treats that as an empty config.
+            Some(raw) if !raw.is_empty() => std::str::from_utf8(raw)
+                .map_err(Error::from)
+                .and_then(proxmox_microseg::parse_running_config)
+                .context("parse /etc/pve/sdn/.running-config"),
+            _ => Ok(Some(MicrosegRunningConfig::default())),
+        }
+    }
+}
+
+#[perlmod::package(name = "PVE::RS::SDN::Microseg::SharedLock", lib = "pve_rs")]
+pub mod pve_rs_sdn_microseg_shared_lock {
+    //! The `PVE::RS::SDN::Microseg::SharedLock` package.
+    //!
+    //! The policy lock in shared mode. A plug takes it before reading the running config and the
+    //! guest, and holds it until the NIC is placed. Released when the object goes away.
+
+    use anyhow::Error;
+    use perlmod::Value;
+    use proxmox_microseg::SharedLock;
+    use proxmox_ve_config::sdn::microseg::GuestInfo;
+
+    use super::pve_rs_sdn_microseg::running_config_from;
+
+    pub struct PerlSharedLock {
+        lock: SharedLock,
+    }
+
+    perlmod::declare_magic!(Box<PerlSharedLock> : &PerlSharedLock as "PVE::RS::SDN::Microseg::SharedLock");
+
+    /// Class method: Take the lock. Fails when a full pass holds it past the lock timeout.
+    #[export]
+    pub fn new(#[raw] class: Value) -> Result<Value, Error> {
+        let lock = proxmox_microseg::lock_shared()?;
+        Ok(perlmod::instantiate_magic!(&class, MAGIC => Box::new(PerlSharedLock { lock })))
+    }
+
+    /// Method: Enforce the microseg policy on the guest NIC `iface`, `raw` as for the full pass.
+    /// Returns false for a running config without a microseg block. Fails where only a full pass
+    /// can place the NIC.
+    #[export]
+    pub fn apply_iface(
+        #[try_from_ref] this: &PerlSharedLock,
+        raw: Option<&[u8]>,
+        guest: GuestInfo,
+        iface: &str,
+        firewall_bridge: bool,
+    ) -> Result<bool, Error> {
+        let Some(cfg) = running_config_from(raw)? else {
+            return Ok(false);
+        };
+        proxmox_microseg::apply_iface(&this.lock, &cfg, &guest, iface, firewall_bridge)?;
+        Ok(true)
+    }
+}
+
+#[perlmod::package(name = "PVE::RS::SDN::Microseg::ExclusiveLock", lib = "pve_rs")]
+pub mod pve_rs_sdn_microseg_exclusive_lock {
+    //! The `PVE::RS::SDN::Microseg::ExclusiveLock` package.
+    //!
+    //! The policy lock in exclusive mode. A full pass takes it before reading the running config
+    //! and the inventory, and holds it until the node is synced. Released when the object goes
+    //! away.
+
+    use std::sync::Mutex;
+
+    use anyhow::Error;
+    use perlmod::Value;
+    use proxmox_microseg::ExclusiveLock;
+    use proxmox_ve_config::sdn::microseg::GuestInfo;
+
+    use super::pve_rs_sdn_microseg::running_config_from;
+
+    pub struct PerlExclusiveLock {
+        lock: Mutex<ExclusiveLock>,
+    }
+
+    perlmod::declare_magic!(Box<PerlExclusiveLock> : &PerlExclusiveLock as "PVE::RS::SDN::Microseg::ExclusiveLock");
+
+    /// Class method: Take the lock. Fails when plugs or a pass hold it past the lock timeout.
+    #[export]
+    pub fn new(#[raw] class: Value) -> Result<Value, Error> {
+        let lock = Mutex::new(proxmox_microseg::lock_exclusive()?);
+        Ok(perlmod::instantiate_magic!(&class, MAGIC => Box::new(PerlExclusiveLock { lock })))
+    }
+
+    /// Method: Enforce the microseg policy on this whole node. `raw` is the content of
+    /// `/etc/pve/sdn/.running-config`, `undef` or empty before the first commit. Returns false
+    /// and leaves the node untouched for a running config without a microseg block.
+    #[export]
+    pub fn apply(
+        #[try_from_ref] this: &PerlExclusiveLock,
+        raw: Option<&[u8]>,
+        inventory: Vec<GuestInfo>,
+    ) -> Result<bool, Error> {
+        let Some(cfg) = running_config_from(raw)? else {
+            return Ok(false);
+        };
+        let mut lock = this.lock.lock().unwrap();
+        proxmox_microseg::apply(&mut lock, &cfg, &inventory)?;
+        Ok(true)
+    }
 }
-- 
2.47.3