[PATCH qemu-server v4 16/27] api: destroy_vm: add option to handle dangling IPSet references

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

For each guest with IPAM entries, a 'guest-ipam-<vmid>' IPSet is
auto-generated. Therefore, deleting a guest can lead to firewall rules
referencing non-existing IPSets, which the firewall fails to parse and
ignores.

Add a 'dangling-ipset-references' option for DELETE
/nodes/{node}/qemu/{vmid} allowing to 'drop' rules referencing
now-deleted IPSets, to 'disable' them, or to 'keep' them as they are.

Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
 src/PVE/API2/Qemu.pm | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/src/PVE/API2/Qemu.pm b/src/PVE/API2/Qemu.pm
index cfbc1f51..bba6c270 100644
--- a/src/PVE/API2/Qemu.pm
+++ b/src/PVE/API2/Qemu.pm
@@ -56,6 +56,7 @@ use PVE::AccessControl;
 use PVE::INotify;
 use PVE::Network;
 use PVE::Firewall;
+use PVE::Firewall::References;
 use PVE::API2::Firewall::VM;
 use PVE::API2::Qemu::Agent;
 use PVE::API2::Qemu::HMPPerms;
@@ -2838,6 +2839,15 @@ __PACKAGE__->register_method({
                 optional => 1,
                 default => 0,
             },
+            'dangling-ipset-references' => {
+                type => 'string',
+                enum => ['keep', 'disable', 'drop'],
+                optional => 1,
+                default => 'keep',
+                description => 'Handle firewall rules referencing the IPSet auto-generated for '
+                    . 'this guest (\'guest-ipam-<vmid>\'). Use \'disable\' to disable them, or '
+                    . '\'drop\' to remove them entirely.',
+            },
         },
     },
     returns => {
@@ -2915,6 +2925,16 @@ __PACKAGE__->register_method({
                         }
                     }
 
+                    my $action = $param->{'dangling-ipset-references'} // 'keep';
+                    if ($action ne 'keep') {
+                        eval {
+                            PVE::Firewall::References::update_guest_ipam_ipset_refs(
+                                $vmid, $action,
+                            );
+                        };
+                        warn "could not $action dangling IPSet references: $@" if $@;
+                    }
+
                     # only now remove the zombie config, else we can have reuse race
                     PVE::QemuConfig->destroy_config($vmid);
                 },
-- 
2.47.3