[PATCH pve-container v3 43/45] lxc: update the microseg enforcement on a tag or hostname change

[Hannes Laimer <h.laimer@proxmox.com>]

The groups of a container's NICs depend on its tags and hostname, but
a change of those took effect at the next start of the container or
the next network reload of the node. Update the NICs of a running
container once the new config is written, so the change applies right
away. The update reads the config under the same lock as a network
reload, so a reload running at the same time cannot leave the old
groups in place. A failed update only warns, and the next reload or
start catches up.

Moving a container between groups is an SDN change like putting a NIC
on a vnet, which needs SDN.Use on the vnet. So a tag or hostname
change that can move the container also needs SDN.Use on
/sdn/microseg, and so does creating a container with such a tag or
hostname.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 src/PVE/API2/LXC/Config.pm |  3 +++
 src/PVE/LXC.pm             | 28 ++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/src/PVE/API2/LXC/Config.pm b/src/PVE/API2/LXC/Config.pm
index 805eac0eac38..1ba8c5d865de 100644
--- a/src/PVE/API2/LXC/Config.pm
+++ b/src/PVE/API2/LXC/Config.pm
@@ -262,6 +262,9 @@ __PACKAGE__->register_method({
             $conf = PVE::LXC::Config->load_config($vmid);
 
             PVE::LXC::update_lxc_config($vmid, $conf);
+            # reads the tags and hostname from pmxcfs, so after the write
+            PVE::LXC::update_nets_enforcement($conf, $vmid)
+                if $running && grep { $_ eq 'tags' || $_ eq 'hostname' } (keys %$param, @delete);
             raise_param_exc($errors) if scalar(keys %$errors);
         };
 
diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm
index 44ae4fa69bef..0472d1b16bf5 100644
--- a/src/PVE/LXC.pm
+++ b/src/PVE/LXC.pm
@@ -25,6 +25,7 @@ use PVE::GuestHelpers qw(check_vnet_access safe_string_ne safe_num_ne safe_boole
 use PVE::INotify;
 use PVE::JSONSchema qw(get_standard_option);
 use PVE::Network;
+use PVE::Network::SDN::Microseg;
 use PVE::Network::SDN::Vnets;
 use PVE::Network::SDN::Zones;
 use PVE::ProcFSTools;
@@ -1122,6 +1123,21 @@ sub net_tap_plug : prototype($$) {
     PVE::Tools::run_command(['/sbin/ip', 'link', 'set', 'dev', $iface, 'up']);
 }
 
+# the groups of a NIC depend on the container's tags and hostname
+sub update_nets_enforcement {
+    my ($conf, $vmid) = @_;
+
+    for my $opt (keys %$conf) {
+        next if $opt !~ m/^net(\d+)$/;
+        my $iface = "veth${vmid}i$1";
+        next if !-d "/sys/class/net/$iface";
+        my $net = PVE::LXC::Config->parse_lxc_network($conf->{$opt});
+        next if ($net->{type} // '') ne 'veth';
+        my $firewall = $net->{firewall} && PVE::Firewall::Helpers::needs_fwbr($net->{bridge});
+        PVE::Network::SDN::Zones::tap_update($iface, $firewall);
+    }
+}
+
 sub update_net {
     my ($vmid, $conf, $opt, $newnet, $netid, $rootdir) = @_;
 
@@ -1691,6 +1707,12 @@ sub check_ct_modify_config_perm {
             raise_perm_exc("configuring device passthrough is only allowed for root\@pam");
         } elsif ($opt eq 'nameserver' || $opt eq 'searchdomain' || $opt eq 'hostname') {
             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Network']);
+            PVE::Network::SDN::Microseg::check_name_access(
+                $rpcenv,
+                $authuser,
+                $oldconf->{$opt},
+                $delete ? undef : $newconf->{$opt},
+            ) if $opt eq 'hostname';
         } elsif ($opt eq 'features') {
             raise_perm_exc(
                 "changing feature flags for privileged container is only allowed for root\@pam")
@@ -1744,6 +1766,12 @@ sub check_ct_modify_config_perm {
             my $old = $oldconf->{$opt};
             my $new = $delete ? '' : $newconf->{$opt};
             PVE::GuestHelpers::assert_tag_permissions($vmid, $old, $new, $rpcenv, $authuser);
+            PVE::Network::SDN::Microseg::check_tag_access(
+                $rpcenv,
+                $authuser,
+                $old,
+                PVE::GuestHelpers::get_unique_tags($new),
+            );
         } else {
             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']);
         }
-- 
2.47.3