[PATCH pve-network v4 26/45] sdn: microseg: add name regex matcher

[Hannes Laimer <h.laimer@proxmox.com>]

A name regex matcher binds every guest whose name matches a regular
expression. For a container the name is its hostname.

A rename into or out of the names a matcher covers moves the guest
between groups. So a check for renames asks for SDN.Use on
/sdn/microseg, like the one for tag changes.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 src/PVE/Network/SDN/Microseg.pm | 41 +++++++++++++++++++++++++++++----
 1 file changed, 36 insertions(+), 5 deletions(-)

diff --git a/src/PVE/Network/SDN/Microseg.pm b/src/PVE/Network/SDN/Microseg.pm
index 4b322dede8be..2c8e37fd341b 100644
--- a/src/PVE/Network/SDN/Microseg.pm
+++ b/src/PVE/Network/SDN/Microseg.pm
@@ -33,9 +33,18 @@ PVE::JSONSchema::register_standard_option(
     },
 );
 
+PVE::JSONSchema::register_format(
+    'pve-sdn-microseg-name-regex',
+    sub {
+        my ($regex) = @_;
+        die "name regex '$regex' contains non-ASCII characters\n" if $regex =~ m/[^\x00-\x7f]/;
+        return $regex;
+    },
+);
+
 cfs_register_file('sdn/microseg.cfg', \&parse_microseg_config, \&write_microseg_config);
 
-our $ASSIGNMENT_TYPES = ['guest-assignment', 'tag-assignment'];
+our $ASSIGNMENT_TYPES = ['guest-assignment', 'tag-assignment', 'regex-assignment'];
 
 sub parse_microseg_config {
     my ($filename, $raw) = @_;
@@ -224,7 +233,8 @@ sub assignment_properties {
             type => 'string',
             enum => $ASSIGNMENT_TYPES,
             description => "The matcher kind. 'guest-assignment' binds a specific guest,"
-                . " 'tag-assignment' every guest carrying the matched tags.",
+                . " 'tag-assignment' every guest carrying the matched tags, 'regex-assignment'"
+                . " every guest whose name matches a regex.",
         };
         $properties->{vmid} = get_standard_option(
             'pve-vmid',
@@ -255,6 +265,17 @@ sub assignment_properties {
             description => "How tags match. 'any' shares a listed tag, 'all' carries every"
                 . " listed tag, 'exact' equals the listed set.",
         };
+        $properties->{'name-regex'} = {
+            type => 'string',
+            format => 'pve-sdn-microseg-name-regex',
+            minLength => 1,
+            maxLength => 1024,
+            'type-property' => 'type',
+            'instance-types' => ['regex-assignment'],
+            description => "A regular expression matched against each guest's name, ASCII only."
+                . " It matches anywhere in the name, so anchor it with '^' and '\$' for a"
+                . " whole-name match. A guest without a name is never matched.",
+        };
         $properties->{iface} = {
             type => 'integer',
             minimum => 0,
@@ -300,11 +321,20 @@ sub check_tag_access {
     $rpcenv->check($authuser, '/sdn/microseg', ['SDN.Use']);
 }
 
+sub check_name_access {
+    my ($rpcenv, $authuser, $old, $new) = @_;
+
+    my $policy = running_policy(PVE::Network::SDN::running_config());
+    return if !$policy->name_match_changed($old, $new);
+    $rpcenv->check($authuser, '/sdn/microseg', ['SDN.Use']);
+}
+
 sub guest_inventory {
     my (%opts) = @_;
 
-    # the data plane takes a guest's NICs from the node, so an apply leaves them out
-    my @props = ('tags', $opts{skip_nics} ? () : map { "net$_" } 0 .. $MAX_NIC_INDEX);
+    # the data plane takes a guest's NICs from the node
+    my @props =
+        ('tags', 'name', 'hostname', $opts{skip_nics} ? () : map { "net$_" } 0 .. $MAX_NIC_INDEX);
 
     my $by_vmid = PVE::Cluster::get_guest_config_properties(\@props, $opts{vmid});
 
@@ -319,6 +349,7 @@ sub guest_inventory {
         push @$inventory,
             {
                 vmid => $vmid,
+                name => $guest->{name} // $guest->{hostname},
                 tags => \@tags,
                 nics => \@nics,
             };
@@ -347,7 +378,7 @@ my sub parse_guest_nic {
     return $iface =~ m/^(?:tap|veth)(\d+)i(\d+)$/;
 }
 
-# the guest as the inventory lists it, with nothing but its vmid when it has no tags
+# the inventory leaves out a guest without tags and name
 my sub guest_info {
     my ($vmid) = @_;
 
-- 
2.47.3