[PATCH pve-firewall v4 04/27] firewall: references: add wrappers for the SDN-generated IPSets

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

SDN generates IPSets that cannot be deleted directly, but rather
disappear once the config stops generating them: the 4 IPSets of a VNet
go away with the VNet, and a guest's IPAM IPSet goes away once the guest
is destroyed. Rules referencing those are left dangling as well.

Add update_sdn_ipset_refs() for a list of such IPSets,
update_vnet_ipset_refs() for the four IPSets of a VNet, and
update_guest_ipam_ipset_refs() for a guest's IPAM IPSet. They lock the
cluster config around update_refs(), save it, and log what they
changed.

The callers are PUT /cluster/sdn in pve-network, and the guest destroy
endpoints in qemu-server and pve-container.

Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
 src/PVE/Firewall/References.pm | 77 ++++++++++++++++++++++++++++++++++
 1 file changed, 77 insertions(+)

diff --git a/src/PVE/Firewall/References.pm b/src/PVE/Firewall/References.pm
index fb25bc2..37df434 100644
--- a/src/PVE/Firewall/References.pm
+++ b/src/PVE/Firewall/References.pm
@@ -458,4 +458,81 @@ sub log_ref_line {
     return;
 }
 
+=head3 update_sdn_ipset_refs($ipsets, $action, $subject, $log)
+
+Apply C<$action> to all references to the SDN-generated IPSets in C<$ipsets>.
+
+C<$subject> names what made them go away for the log, and C<$log> is where that account goes.
+
+Return the number of references changed.
+
+=cut
+
+sub update_sdn_ipset_refs {
+    my ($ipsets, $action, $subject, $log) = @_;
+
+    die "SDN IPSets cannot be renamed\n" if $action && $action eq 'rename';
+
+    my $count = 0;
+
+    PVE::Firewall::lock_clusterfw_conf(
+        10,
+        sub {
+            my $conf = PVE::Firewall::load_clusterfw_conf();
+
+            $count = update_refs({
+                conf => $conf,
+                kind => 'ipset',
+                old => $ipsets,
+                env => 'sdn',
+                action => $action,
+                subject => $subject,
+                log => $log,
+            });
+
+            PVE::Firewall::save_clusterfw_conf($conf);
+        },
+    );
+
+    return $count;
+}
+
+=head3 update_vnet_ipset_refs($vnets, $action, $log)
+
+Apply C<$action> to all references to the auto-generated IPSets for C<$vnets>.
+
+Return the number of references changed.
+
+=cut
+
+sub update_vnet_ipset_refs {
+    my ($vnets, $action, $log) = @_;
+
+    my $ipsets = [
+        map {
+            my $vnet = $_;
+            map { "$vnet-$_" } qw(all gateway no-gateway dhcp)
+        } $vnets->@*
+    ];
+
+    my $names = join(', ', map { "'$_'" } $vnets->@*);
+    my $subject = scalar($vnets->@*) > 1 ? "vnets $names removed" : "vnet $names removed";
+
+    return update_sdn_ipset_refs($ipsets, $action, $subject, $log);
+}
+
+=head3 update_guest_ipam_ipset_refs($vmid, $action)
+
+Apply C<$action> to all references to the IPAM IPSet of the guest C<$vmid>.
+
+Return the number of references changed.
+
+=cut
+
+sub update_guest_ipam_ipset_refs {
+    my ($vmid, $action) = @_;
+
+    return update_sdn_ipset_refs("guest-ipam-$vmid", $action, "guest $vmid destroyed");
+}
+
 1;
-- 
2.47.3