[PATCH pve-network v3 29/45] sdn: microseg: allow nesting groups under a parent

[Hannes Laimer <h.laimer@proxmox.com>]

A group can name a parent group. An interface in a subgroup then
belongs to every group above it as well. The parent can be changed or
removed on an existing group, since a referenced group cannot be
deleted and created again.

At a priority tie an all or exact rule on a subgroup outranks the same
rule on its parent. The specificity of such a rule counts the parents
of its groups, so the rule alone does not show it. The listing of all
microseg objects reports it for each rule.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 src/PVE/API2/Network/SDN/Microseg.pm | 11 +++++++++++
 src/PVE/Network/SDN/Microseg.pm      | 13 +++++++++++--
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/src/PVE/API2/Network/SDN/Microseg.pm b/src/PVE/API2/Network/SDN/Microseg.pm
index 5d4062f7db30..e01989d9a923 100644
--- a/src/PVE/API2/Network/SDN/Microseg.pm
+++ b/src/PVE/API2/Network/SDN/Microseg.pm
@@ -132,6 +132,15 @@ __PACKAGE__->register_method({
                                 . ' in evaluation order and assignments in match order. The'
                                 . ' first has the lowest number.',
                         },
+                        specificity => {
+                            type => 'integer',
+                            optional => 1,
+                            description =>
+                                "The number of groups the rule's 'all' and 'exact' predicates"
+                                . ' require, the parents of a named group included. At a priority'
+                                . ' tie the rules with the highest number decide. Rule objects'
+                                . ' only.',
+                        },
                         $OBJECT_PROPERTIES->%*,
                     },
                 },
@@ -206,10 +215,12 @@ __PACKAGE__->register_method({
             PVE::Network::SDN::Microseg::audited_guest_inventory(),
         );
         my $rank = { $config->rule_order()->%*, $config->assignment_order()->%* };
+        my $specificity = $config->rule_specificity();
         for my $object (@$objects) {
             my $id = $object->{id};
             $object->{members} = $members->{$id} if defined($members->{$id});
             $object->{rank} = $rank->{$id} if defined($rank->{$id});
+            $object->{specificity} = $specificity->{$id} if defined($specificity->{$id});
         }
 
         my $registry = ($running_cfg->{microseg} // {})->{identities};
diff --git a/src/PVE/Network/SDN/Microseg.pm b/src/PVE/Network/SDN/Microseg.pm
index c5023c17b1d9..0732577dc42d 100644
--- a/src/PVE/Network/SDN/Microseg.pm
+++ b/src/PVE/Network/SDN/Microseg.pm
@@ -100,11 +100,19 @@ sub group_properties {
     my ($update) = @_;
 
     my $properties = {
+        parent => {
+            type => 'string',
+            format => 'pve-sdn-microseg-id',
+            optional => 1,
+            description => "The group this one is a subgroup of. An interface in a subgroup is"
+                . " also in every group above it, so 'any' and 'all' rules on a group cover"
+                . " its subgroups, while rules on the subgroup cover only the subgroup.",
+        },
         comment => $COMMENT_PROPERTY,
     };
 
     if ($update) {
-        $properties->{delete} = delete_property('comment');
+        $properties->{delete} = delete_property('parent', 'comment');
     }
 
     return $properties;
@@ -128,7 +136,8 @@ sub rule_properties {
             optional => 1,
             ($update ? () : (default => 0)),
             description => "Priority. The highest-priority matching rule wins."
-                . " At a tie, a deny overrides an allow."
+                . " At a tie the most specific rules decide, and among equally specific ones"
+                . " a deny overrides an allow."
                 . " A narrowed rule is checked ahead of an unnarrowed rule at the same priority.",
         },
         comment => $COMMENT_PROPERTY,
-- 
2.47.3