[PATCH pve-container v4 17/27] api: destroy_vm: add option to handle dangling IPSet references

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

For each guest with IPAM entries, a 'guest-ipam-<vmid>' IPSet is
auto-generated [0]. Therefore, deleting a guest can lead to firewall
rules referencing non-existing IPSets, which the firewall fails to
parse and ignores.

Add a 'dangling-ipset-references' option for DELETE
/nodes/{node}/lxc/{vmid} allowing to 'drop' rules referencing
now-deleted IPSets, to 'disable' them, or to 'keep' them as they are.

[0] https://pve.proxmox.com/wiki/Software-Defined_Network#pvesdn_firewall_integration

Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
 src/PVE/API2/LXC.pm | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/PVE/API2/LXC.pm b/src/PVE/API2/LXC.pm
index 5f94d5a..f0d7438 100644
--- a/src/PVE/API2/LXC.pm
+++ b/src/PVE/API2/LXC.pm
@@ -13,6 +13,7 @@ use PVE::Cluster qw(cfs_read_file);
 use PVE::DataCenterConfig;
 use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
 use PVE::Firewall;
+use PVE::Firewall::References;
 use PVE::GuestHelpers;
 use PVE::INotify;
 use PVE::JSONSchema qw(get_standard_option);
@@ -845,6 +846,15 @@ __PACKAGE__->register_method({
                     . " enabled storages which are not referenced in the config.",
                 optional => 1,
             },
+            'dangling-ipset-references' => {
+                type => 'string',
+                enum => ['keep', 'disable', 'drop'],
+                optional => 1,
+                default => 'keep',
+                description => 'Handle firewall rules referencing the IPSet auto-generated for '
+                    . 'this guest (\'guest-ipam-<vmid>\'). Use \'disable\' to disable them, or '
+                    . '\'drop\' to remove them entirely.',
+            },
         },
     },
     returns => {
@@ -922,6 +932,14 @@ __PACKAGE__->register_method({
                 }
             }
 
+            my $action = $param->{'dangling-ipset-references'} // 'keep';
+            if ($action ne 'keep') {
+                eval {
+                    PVE::Firewall::References::update_guest_ipam_ipset_refs($vmid, $action);
+                };
+                warn "could not $action dangling IPSet references: $@" if $@;
+            }
+
             # only now remove the zombie config, else we can have reuse race
             PVE::LXC::Config->destroy_config($vmid);
         };
-- 
2.47.3