[PATCH pve-firewall v6 08/28] firewall: ipset: add option to handle dangling references on delete

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

Deleting an ipset referenced by rules or security groups leaves dangling
references, which the firewall fails to parse and drops.

Add a 'dangling-references' option to the delete endpoint, to either
'disable' the referencing rules or 'drop' them along with the ipset. The
default, 'keep', leaves them as they are. For cluster ipsets, this also
covers all downstream configs (host, guest and vnet).

Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
 src/PVE/API2/Firewall/IPSet.pm | 14 ++++++++++++++
 src/PVE/Firewall.pm            | 12 ++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/src/PVE/API2/Firewall/IPSet.pm b/src/PVE/API2/Firewall/IPSet.pm
index 9d3c562..144baf6 100644
--- a/src/PVE/API2/Firewall/IPSet.pm
+++ b/src/PVE/API2/Firewall/IPSet.pm
@@ -2,6 +2,7 @@ package PVE::API2::Firewall::IPSetBase;
 
 use strict;
 use warnings;
+use PVE::Firewall::References qw(update_refs);
 use PVE::Exception qw(raise raise_param_exc);
 use PVE::JSONSchema qw(get_standard_option);
 
@@ -135,6 +136,7 @@ sub register_delete_ipset {
     my $properties = $class->additional_parameters();
 
     $properties->{name} = get_standard_option('ipset-name');
+    $properties->{'dangling-references'} = get_standard_option('pve-dangling-references-delete');
     $properties->{force} = {
         type => 'boolean',
         optional => 1,
@@ -166,6 +168,18 @@ sub register_delete_ipset {
                     die "IPSet '$param->{name}' is not empty\n"
                         if scalar(@$ipset) && !$param->{force};
 
+                    my $action = $param->{'dangling-references'}
+                        // $properties->{'dangling-references'}->{default};
+
+                    update_refs({
+                        conf => $fw_conf,
+                        kind => 'ipset',
+                        old => $param->{name},
+                        env => $class->rule_env(),
+                        action => $action eq 'keep' ? undef : $action,
+                        subject => "ipset '$param->{name}' deleted",
+                    });
+
                     $class->save_ipset($param, $fw_conf, undef);
 
                 },
diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index d4e1ad9..85ad23e 100644
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -223,6 +223,18 @@ PVE::JSONSchema::register_standard_option(
     },
 );
 
+PVE::JSONSchema::register_standard_option(
+    'pve-dangling-references-delete',
+    {
+        type => 'string',
+        enum => ['keep', 'disable', 'drop'],
+        optional => 1,
+        description => "Handle references that deleting this object would leave dangling. Use "
+            . "'disable' to disable the referencing rules, or 'drop' to remove them entirely.",
+        default => 'keep',
+    },
+);
+
 PVE::JSONSchema::register_standard_option(
     'pve-dangling-references-force-rename',
     {
-- 
2.47.3