CP-312187: Allow networks to restrict VM PXE boot protocols

[GeraldEV]

This improvement is from a customer request to avoid network boot using disabled internet protocols specifically on UEFI VMs.
The network itself is restricted from using the specific protocol hence the restriction is applied at the network level.
For the initial feature implementation, we determine that a VM is unable to use a specific protocol if the protocol is disabled on any of the networks attached. The VMs in question are expected to only have a single network.
In future it may make sense to provide finer granularity by applying the restriction to the VM or to the VIF itself.

The Toolstack will populate a XenStore entry before the VM boots which the virtual firmware will read to determine if a boot device is valid.
In XenServer, the firmware will assume the protocol is enabled unless it can; access XenStore, determine the XenStore entry for the protocol exists, read the entry, confirm the entry is exactly "false".
Along with populating the default network value on create/upgrade; this will ensure there is no change in behaviour until a user opts into the feature.

The code in this PR was Co-authored by claude using the Sonnet 5 model

--

After applying updates and restarting:

# xe network-list uuid=bd1e5682-c475-785b-4386-6daba32120ba params=all
uuid ( RO)                    : bd1e5682-c475-785b-4386-6daba32120ba
              name-label ( RW): Pool-wide network 0
        name-description ( RW):
               VIF-uuids (SRO): 3b1e3511-b16d-070f-928d-14accd573aea
               PIF-uuids (SRO): deeee446-70fd-3c0c-d096-b6a5593990fc
                     MTU ( RW): 1500
                  bridge ( RO): xenbr0
                 managed ( RO): true
            other-config (MRW):
                   blobs ( RO):
                    tags (SRW):
    default-locking-mode ( RW): unlocked
                 purpose (SRW):
                pxe-dhcp (MRW): allow-ipv4: true; allow-ipv6: true

Changing the value:

# xe network-param-set pxe-dhcp:allow-ipv4=false uuid=bd1e5682-c475-785b-4386-6daba32120ba

Changed value:

# xe network-list uuid=bd1e5682-c475-785b-4386-6daba32120ba params=all
uuid ( RO)                    : bd1e5682-c475-785b-4386-6daba32120ba
              name-label ( RW): Pool-wide network 0
        name-description ( RW):
               VIF-uuids (SRO): 3b1e3511-b16d-070f-928d-14accd573aea
               PIF-uuids (SRO): deeee446-70fd-3c0c-d096-b6a5593990fc
                     MTU ( RW): 1500
                  bridge ( RO): xenbr0
                 managed ( RO): true
            other-config (MRW):
                   blobs ( RO):
                    tags (SRW):
    default-locking-mode ( RW): unlocked
                 purpose (SRW):
                pxe-dhcp (MRW): allow-ipv4: false; allow-ipv6: true

XenStore populated before first boot:

# xenstore-ls /local/domain/1/dhcp
allow-ipv4 = "false"
allow-ipv6 = "true"

[psafont]

Hi Gerald!

It seems strange to me that this setting is being added to network instead to the VM, or, to be more precise, the template so it can scale; this is because this is a setting that is applied in xenstore, per-VM; instead of being a setting that's being set for the network layer, i.e. openvswitch.

If the setting was about limiting which DHCP is allowed in a network I would agree it makes sense to place it in the network object, but as things stand I'm not convinced.

Is there anything in particular that made you choose to express the setting this way?

[GeraldEV]

Hi Pau! 😄

Our internal design agreed that the network level made sense as this is where the restriction would actually exist (does the physical network support the protocol), but it definitely does complicate determining if a VM can network boot with that protocol or not when multiple networks are involved.
I'm happy to move the setting to the VM or template if you think that's best, are you happy with the String * String approach or is there a better way or place to put the information (other-config, platform, etc)?

[psafont]

are you happy with the String * String approach or is there a better way or place to put the information (other-config, platform, etc)?

I don't think there's a good way to set keys to xenstore, so a custom string map is reasonable. Other might have differing opinions (@last-genius)

[last-genius]

are you happy with the String * String approach or is there a better way or place to put the information (other-config, platform, etc)?

I don't think there's a good way to set keys to xenstore, so a custom string map is reasonable. Other might have differing opinions (@last-genius)

Right now, the map's keys silently get truncated by xenopsd - it's not obvious from the datamodel what the possible values are.

IMO it's better to have two boolean fields: pxe_dhcp_ipv4_allowed and pxe_dhcp_v6_allowed instead of a map here.

[GeraldEV]

Thanks chaps, I'll close this draft PR and open one with the suggested changes after I've tested it :D

[GeraldEV]

Raised #7318