[PATCH pve-network v6 16/28] apply: add option to handle dangling references on VNet deletion

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

For each VNet, 4 IPSets are auto-generated (<vnet>-all, -gateway,
-no-gateway and -dhcp) [0]. Therefore, deleting a VNet can lead to
rules referencing non-existing IPSets, which the firewall fails to
parse and ignores.

Add a 'dangling-ipset-references' option for PUT /cluster/sdn allowing
to 'drop' rules referencing now-deleted IPSets, 'disable' them, or
'keep' them as they are.

[0] https://pve.proxmox.com/wiki/Software-Defined_Network#pvesdn_firewall_integration

Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
 src/PVE/API2/Network/SDN.pm | 39 +++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/src/PVE/API2/Network/SDN.pm b/src/PVE/API2/Network/SDN.pm
index e3c8d9d..cc290e9 100644
--- a/src/PVE/API2/Network/SDN.pm
+++ b/src/PVE/API2/Network/SDN.pm
@@ -8,6 +8,8 @@ use JSON qw(from_json);
 
 use PVE::Cluster qw(cfs_lock_file cfs_read_file cfs_write_file);
 use PVE::Exception qw(raise_param_exc);
+use PVE::Firewall;
+use PVE::Firewall::References;
 use PVE::JSONSchema qw(get_standard_option);
 use PVE::RESTHandler;
 use PVE::RPCEnvironment;
@@ -302,6 +304,15 @@ __PACKAGE__->register_method({
                 description =>
                     'When lock-token has been provided and configuration successfully committed, release the lock automatically afterwards',
             },
+            'dangling-ipset-references' => get_standard_option(
+                'pve-dangling-references-delete',
+                {
+                    description =>
+                        'If the applied SDN changes delete one or more VNets, handle the firewall '
+                        . 'rules referencing their auto-generated IPSets. Use \'disable\' to '
+                        . 'disable those rules, or \'drop\' to remove them entirely.',
+                },
+            ),
         },
     },
     returns => {
@@ -315,13 +326,36 @@ __PACKAGE__->register_method({
 
         my $lock_token = extract_param($param, 'lock-token');
         my $release_lock = extract_param($param, 'release-lock');
+        my $dangling_refs = extract_param($param, 'dangling-ipset-references') // 'keep';
 
         my $previous_config_has_frr;
         my $new_config_has_frr;
 
+        my $ref_log = [];
+        my $ref_err;
+
         PVE::Network::SDN::lock_sdn_config(
             sub {
                 $previous_config_has_frr = PVE::Network::SDN::running_config_has_frr();
+
+                if ($dangling_refs ne 'keep') {
+                    my $running = PVE::Network::SDN::running_config() // {};
+                    my $vnets = PVE::Network::SDN::Vnets::config() // {};
+                    my $removed =
+                        [grep { !$vnets->{ids}->{$_} } keys $running->{vnets}->{ids}->%*];
+
+                    if ($removed->@*) {
+                        eval {
+                            PVE::Firewall::References::update_vnet_ipset_refs(
+                                $removed,
+                                $dangling_refs,
+                                sub { push $ref_log->@*, $_[0] },
+                            );
+                        };
+                        $ref_err = $@ if $@;
+                    }
+                }
+
                 PVE::Network::SDN::commit_config();
                 $new_config_has_frr = PVE::Network::SDN::running_config_has_frr();
 
@@ -336,6 +370,11 @@ __PACKAGE__->register_method({
         my $regenerate_frr = ($previous_config_has_frr || $new_config_has_frr) ? 1 : 0;
 
         my $code = sub {
+            # the rewrite has to happen under the SDN lock and before the config is committed,
+            # which is before there is a task, so only log here.
+            print("$_\n") for $ref_log->@*;
+            warn "could not update references to VNet IPSets: $ref_err" if $ref_err;
+
             $rpcenv->{type} = 'priv'; # to start tasks in background
             PVE::Cluster::check_cfs_quorum();
             my $nodelist = PVE::Cluster::get_nodelist();
-- 
2.47.3