[PATCH pve-network v3 26/45] sdn: microseg: add name regex matcher

[Hannes Laimer <h.laimer@proxmox.com>]

A name regex matcher binds every guest whose name matches a regular
expression. For a container the name is its hostname.

A rename into or out of the names a matcher covers moves the guest
between groups. So a check for renames asks for SDN.Use on
/sdn/microseg, like the one for tag changes.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 src/PVE/Network/SDN/Microseg.pm | 43 +++++++++++++++++++++++++++++----
 1 file changed, 38 insertions(+), 5 deletions(-)

diff --git a/src/PVE/Network/SDN/Microseg.pm b/src/PVE/Network/SDN/Microseg.pm
index 8090043268a7..bdfde447b320 100644
--- a/src/PVE/Network/SDN/Microseg.pm
+++ b/src/PVE/Network/SDN/Microseg.pm
@@ -32,9 +32,18 @@ PVE::JSONSchema::register_standard_option(
     },
 );
 
+PVE::JSONSchema::register_format(
+    'pve-sdn-microseg-name-regex',
+    sub {
+        my ($regex) = @_;
+        die "name regex '$regex' contains non-ASCII characters\n" if $regex =~ m/[^\x00-\x7f]/;
+        return $regex;
+    },
+);
+
 cfs_register_file('sdn/microseg.cfg', \&parse_microseg_config, \&write_microseg_config);
 
-our $ASSIGNMENT_TYPES = ['guest-assignment', 'tag-assignment'];
+our $ASSIGNMENT_TYPES = ['guest-assignment', 'tag-assignment', 'regex-assignment'];
 
 sub parse_microseg_config {
     my ($filename, $raw) = @_;
@@ -203,7 +212,8 @@ sub assignment_properties {
             type => 'string',
             enum => $ASSIGNMENT_TYPES,
             description => "The matcher kind. 'guest-assignment' binds a specific guest,"
-                . " 'tag-assignment' every guest carrying the matched tags.",
+                . " 'tag-assignment' every guest carrying the matched tags, 'regex-assignment'"
+                . " every guest whose name matches a regex.",
         };
         $properties->{vmid} = get_standard_option(
             'pve-vmid',
@@ -234,6 +244,17 @@ sub assignment_properties {
             description => "How tags match. 'any' shares a listed tag, 'all' carries every"
                 . " listed tag, 'exact' equals the listed set.",
         };
+        $properties->{'name-regex'} = {
+            type => 'string',
+            format => 'pve-sdn-microseg-name-regex',
+            minLength => 1,
+            maxLength => 1024,
+            'type-property' => 'type',
+            'instance-types' => ['regex-assignment'],
+            description => "A regular expression matched against each guest's name, ASCII only."
+                . " It matches anywhere in the name, so anchor it with '^' and '\$' for a"
+                . " whole-name match. A guest without a name is never matched.",
+        };
         $properties->{iface} = {
             type => 'integer',
             minimum => 0,
@@ -294,11 +315,22 @@ sub check_tag_access {
     }
 }
 
+# a rename that changes which regex assignments match can move the guest between groups like a
+# tag change, so it needs SDN.Use on the policy. The match runs in the config, so it uses the
+# regex engine that resolves the NICs.
+sub check_name_access {
+    my ($rpcenv, $authuser, $old, $new) = @_;
+
+    return if !config()->name_match_changed($old, $new);
+    $rpcenv->check($authuser, '/sdn/microseg', ['SDN.Use']);
+}
+
 sub guest_inventory {
     my (%opts) = @_;
 
-    # the data plane takes a guest's NICs from the node, so an apply leaves them out
-    my @props = ('tags', $opts{skip_nics} ? () : map { "net$_" } 0 .. $MAX_NIC_INDEX);
+    # the data plane takes a guest's NICs from the node
+    my @props =
+        ('tags', 'name', 'hostname', $opts{skip_nics} ? () : map { "net$_" } 0 .. $MAX_NIC_INDEX);
 
     my $by_vmid = PVE::Cluster::get_guest_config_properties(\@props, $opts{vmid});
 
@@ -313,6 +345,7 @@ sub guest_inventory {
         push @$inventory,
             {
                 vmid => $vmid,
+                name => $guest->{name} // $guest->{hostname},
                 tags => \@tags,
                 nics => \@nics,
             };
@@ -341,7 +374,7 @@ my sub parse_guest_nic {
     return $iface =~ m/^(?:tap|veth)(\d+)i(\d+)$/;
 }
 
-# the guest as the inventory lists it, with nothing but its vmid when it has no tags
+# the inventory leaves out a guest without tags and name
 my sub guest_info {
     my ($vmid) = @_;
 
-- 
2.47.3