[PATCH pve-firewall v3 06/16] api: aliases: add option to handle dangling references on delete

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

Deleting an alias referenced by rules, security groups or ipset members
leaves dangling references, which the firewall fails to parse and drops.

Add a 'dangling-references' option to the delete endpoint, to either
'disable' the referencing rules or 'drop' them along with the alias. The
default, 'keep', leaves them as they are. Ipset members have no disabled
state, so they are removed in both cases. For cluster aliases, this also
covers all downstream configs (host, guest and vnet).

Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
 src/PVE/API2/Firewall/Aliases.pm | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/src/PVE/API2/Firewall/Aliases.pm b/src/PVE/API2/Firewall/Aliases.pm
index b5bad48..8b9caaf 100644
--- a/src/PVE/API2/Firewall/Aliases.pm
+++ b/src/PVE/API2/Firewall/Aliases.pm
@@ -316,6 +316,16 @@ sub register_delete_alias {
 
     $properties->{name} = $api_properties->{name};
     $properties->{digest} = get_standard_option('pve-config-digest');
+    $properties->{'dangling-references'} = {
+        type => 'string',
+        enum => ['keep', 'disable', 'drop'],
+        optional => 1,
+        description =>
+            "Handle references that the deletion would leave dangling. Use 'disable' to disable "
+            . "the referencing rules, or 'drop' to remove them entirely. IPSet members "
+            . "referencing the alias are always removed, as they cannot be disabled.",
+        default => 'keep',
+    };
 
     $class->register_method({
         name => 'remove_alias',
@@ -344,6 +354,20 @@ sub register_delete_alias {
                     PVE::Tools::assert_if_modified($digest, $param->{digest});
 
                     my $name = lc($param->{name});
+
+                    my $action = $param->{'dangling-references'} // 'keep';
+                    if ($action ne 'keep') {
+                        my $spec = get_object_spec('aliases');
+                        update_refs(
+                            $fw_conf,
+                            $spec,
+                            $param->{name},
+                            undef,
+                            $class->rule_env(),
+                            $action,
+                        );
+                    }
+
                     delete $aliases->{$name};
 
                     $class->save_aliases($param, $fw_conf, $aliases);
-- 
2.47.3