ipam: netbox: implement deleting subnets

Deleting a subnet did not delete any created entities in Netbox.
Implement deletion of a subnet by deleting all entities that are
created in Netbox upon creation of a subnet.

We are checking for any leftover IP assignments before deleting the
prefix, so we do not accidentally delete any manually created IP
assignments.

This method tries to check for any possible errors before editing the
entities. There is still a small window where external changes can
occur that lead to errors. We are touching multiple entities here, so
in case of errors users have to fix their Netbox instance manually.

Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
Tested-by: Hannes Duerr <h.duerr@proxmox.com>
Link: https://lore.proxmox.com/20250310085103.30549-2-s.hanreich@proxmox.com
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

1 files changed, 31 insertions, 1 deletions

diff --git a/src/PVE/Network/SDN/Ipams/NetboxPlugin.pm b/src/PVE/Network/SDN/Ipams/NetboxPlugin.pm
index 56a1787..f0b70fd 100644
--- a/src/PVE/Network/SDN/Ipams/NetboxPlugin.pm
+++ b/src/PVE/Network/SDN/Ipams/NetboxPlugin.pm
@@ -71,7 +71,22 @@ sub del_subnet {
 
     my $internalid = get_prefix_id($plugin_config, $cidr, $noerr);
 
-    return; #fixme: check that prefix is empty exluding gateway, before delete
+    # definedness check, because ID could be 0
+    if (!defined($internalid)) {
+	warn "could not find id for ip prefix $cidr";
+	return;
+    }
+
+    if (!is_prefix_empty($plugin_config, $cidr, $noerr)) {
+	return if $noerr;
+	die "not deleting prefix $cidr because it still contains entries";
+    }
+
+    # last IP is assumed to be the gateway, delete it
+    if (!$class->del_ip($plugin_config, $subnetid, $subnet, $subnet->{gateway}, $noerr)) {
+	return if $noerr;
+	die "could not delete gateway ip from subnet $subnetid";
+    }
 
     eval {
 	netbox_api_request($plugin_config, "DELETE", "/ipam/prefixes/$internalid/");
@@ -217,6 +232,8 @@ sub del_ip {
     if ($@) {
 	die "error delete ip $ip : $@" if !$noerr;
     }
+
+    return 1;
 }
 
 sub get_ips_from_mac {
@@ -324,6 +341,19 @@ sub is_ip_gateway {
     return $is_gateway;
 }
 
+sub is_prefix_empty {
+    my ($config, $cidr, $noerr) = @_;
+
+    my $result = eval { netbox_api_request($config, "GET", "/ipam/ip-addresses/?parent=$cidr") };
+    if ($@) {
+	return if $noerr;
+	die "could not query children for prefix $cidr: $@";
+    }
+
+    # checking against 1, because we do not count the gateway
+    return scalar(@{$result->{results}}) <= 1;
+}
+
 1;