[PATCH pve-network v2 14/27] sdn: zones: trigger microseg apply on tap_plug

[Hannes Laimer <h.laimer@proxmox.com>]

Attach enforcement when a guest NIC is plugged, before it is added to
the bridge, so an assigned NIC never passes traffic unenforced. A
failure to enforce fails the plug, and with it the guest start, instead
of bringing the NIC up open.

This adds the two agent invocation helpers to the microseg module: the
per-interface one used here, and a full resync for the network reload
path.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 src/PVE/Network/SDN/Microseg.pm | 33 +++++++++++++++++++++++++++++++++
 src/PVE/Network/SDN/Zones.pm    |  6 ++++++
 2 files changed, 39 insertions(+)

diff --git a/src/PVE/Network/SDN/Microseg.pm b/src/PVE/Network/SDN/Microseg.pm
index 82ee52d..4f135c6 100644
--- a/src/PVE/Network/SDN/Microseg.pm
+++ b/src/PVE/Network/SDN/Microseg.pm
@@ -422,4 +422,37 @@ sub list_objects {
     return $res;
 }
 
+my $MICROSEG_AGENT = '/usr/libexec/proxmox/proxmox-ebpf';
+
+sub apply_interface {
+    my ($iface) = @_;
+
+    return if !-x $MICROSEG_AGENT;
+
+    # An assigned NIC that cannot be enforced must not come up, so a non-zero exit fails the plug
+    # and the task that triggered it. Capture the agent's output and put it in the error so that
+    # task shows why, instead of a bare exit code.
+    my $output = '';
+    my $collect = sub { $output .= "$_[0]\n" };
+    eval {
+        PVE::Tools::run_command(
+            [$MICROSEG_AGENT, 'apply', $iface],
+            outfunc => $collect,
+            errfunc => $collect,
+        );
+    };
+    if (my $err = $@) {
+        chomp $output;
+        die "microseg: refusing to bring up '$iface' unenforced\n"
+            . ($output ne '' ? "$output\n" : "$err");
+    }
+}
+
+sub apply_all {
+    return if !-x $MICROSEG_AGENT;
+
+    eval { PVE::Tools::run_command([$MICROSEG_AGENT, 'apply']); };
+    warn "microseg: failed to apply running config: $@" if $@;
+}
+
 1;
diff --git a/src/PVE/Network/SDN/Zones.pm b/src/PVE/Network/SDN/Zones.pm
index 4c1468c..1af5e5c 100644
--- a/src/PVE/Network/SDN/Zones.pm
+++ b/src/PVE/Network/SDN/Zones.pm
@@ -10,6 +10,7 @@ use PVE::Cluster qw(cfs_read_file cfs_write_file cfs_lock_file);
 use PVE::Network;
 
 use PVE::Network::SDN::Vnets;
+use PVE::Network::SDN::Microseg;
 use PVE::Network::SDN::Zones::VlanPlugin;
 use PVE::Network::SDN::Zones::QinQPlugin;
 use PVE::Network::SDN::Zones::VxlanPlugin;
@@ -332,6 +333,8 @@ sub tap_plug {
         $opts->{learning} = 0
             if $interfaces_config->{ifaces}->{$bridge}
             && $interfaces_config->{ifaces}->{$bridge}->{'bridge-disable-mac-learning'};
+        # attach enforcement before bridging, so the NIC never passes traffic unenforced
+        PVE::Network::SDN::Microseg::apply_interface($iface);
         PVE::Network::tap_plug($iface, $bridge, $tag, $firewall, $trunks, $rate, $opts);
         return;
     }
@@ -343,6 +346,9 @@ sub tap_plug {
         if $plugin_config->{nodes} && !defined($plugin_config->{nodes}->{$nodename});
 
     my $plugin = PVE::Network::SDN::Zones::Plugin->lookup($plugin_config->{type});
+
+    # attach enforcement before bridging, so the NIC never passes traffic unenforced
+    PVE::Network::SDN::Microseg::apply_interface($iface);
     $plugin->tap_plug($plugin_config, $vnet, $tag, $iface, $bridge, $firewall, $trunks, $rate);
 }
 
-- 
2.47.3