[PATCH qemu-server v3 09/16] api: destroy_vm: add option to handle dangling IPSet references

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

For each guest with IPAM entries, a 'guest-ipam-<vmid>' IPSet is
auto-generated [0]. Therefore, deleting a guest can lead to firewall
rules referencing non-existing IPSets, which the firewall fails to
parse and ignores.

Add a 'dangling-ipset-references' option for DELETE
/nodes/{node}/qemu/{vmid} allowing to 'drop' rules referencing
now-deleted IPSets, to 'disable' them, or to 'keep' them as they are.

[0] https://pve.proxmox.com/wiki/Software-Defined_Network#pvesdn_firewall_integration

Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
 src/PVE/API2/Qemu.pm | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/src/PVE/API2/Qemu.pm b/src/PVE/API2/Qemu.pm
index 922c6599..75219ad0 100644
--- a/src/PVE/API2/Qemu.pm
+++ b/src/PVE/API2/Qemu.pm
@@ -2818,6 +2818,16 @@ __PACKAGE__->register_method({
                 optional => 1,
                 default => 0,
             },
+            'dangling-ipset-references' => {
+                type => 'string',
+                enum => ['keep', 'disable', 'drop'],
+                optional => 1,
+                default => 'keep',
+                description => 'Handle firewall rules referencing the IPSet auto-generated for '
+                    . 'this guest (\'guest-ipam-<vmid>\'). Use \'disable\' to disable them, or '
+                    . '\'drop\' to remove them entirely. Kept as they are, they reference an IPSet '
+                    . 'that no longer exists and are dropped from the generated ruleset.',
+            },
         },
     },
     returns => {
@@ -2895,6 +2905,16 @@ __PACKAGE__->register_method({
                         }
                     }
 
+                    my $action = $param->{'dangling-ipset-references'} // 'keep';
+                    if ($action ne 'keep') {
+                        eval {
+                            PVE::Firewall::Helpers::update_guest_ipam_ipset_refs(
+                                $vmid, $action,
+                            );
+                        };
+                        warn "could not $action dangling IPSet references: $@" if $@;
+                    }
+
                     # only now remove the zombie config, else we can have reuse race
                     PVE::QemuConfig->destroy_config($vmid);
                 },
-- 
2.47.3