replication: prepare: safeguard against removal if expected snapshot is missing

Such a check would also have prevented the issue in 1aa4d84
("ReplicationState: purge state from non local vms") and other
scenarios where state and disk state are inconsistent with regard to
the last_sync snapshot.

AFAICT, all existing callers intending to remove all snapshots use
last_sync=1 so chaning the behavior for other (non-zero) values should
be fine.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>

diff --git a/src/PVE/Replication.pm b/src/PVE/Replication.pm
index 33fcc485b1d37a90f94f7ab8f4abf36ddb84ca70..8591d0ec00aa8dc1f775bc1dd72c0412646f8067 100644 (file)
--- a/src/PVE/Replication.pm
+++ b/src/PVE/Replication.pm
@@ -153,9 +153,9 @@ sub remote_finalize_local_job {
     PVE::Tools::run_command($cmd, outfunc => $logger, errfunc => $logger);
 }
 
-# Finds all local snapshots and removes replication snapshots not matching $last_sync. Use
-# last_sync=0 (or undef) to prevent removal (useful if VM was stolen). Use last_sync=1 to remove all
-# replication snapshots (limited to job if specified).
+# Finds all local snapshots and removes replication snapshots not matching $last_sync after checking
+# that it is present. Use last_sync=0 (or undef) to prevent removal (useful if VM was stolen). Use
+# last_sync=1 to remove all replication snapshots (limited to job if specified).
 sub prepare {
     my ($storecfg, $volids, $jobid, $last_sync, $parent_snapname, $logfunc) = @_;
 
@@ -173,12 +173,19 @@ sub prepare {
     my $cleaned_replicated_volumes = {};
     foreach my $volid (@$volids) {
        my $info = PVE::Storage::volume_snapshot_info($storecfg, $volid);
+
+       my $removal_ok = !defined($snapname) || $info->{$snapname};
+       $removal_ok = 0 if $last_sync == 0; # last_sync=0 if the VM was stolen, don't remove!
+       $removal_ok = 1 if $last_sync == 1; # last_sync=1 is a special value used to remove all
+       $logfunc->("expected snapshot $snapname not present for $volid, not removing others")
+           if !$removal_ok && $last_sync > 1;
+
        for my $snap (keys $info->%*) {
            if ( # check if it's a stale replication snapshot
                !(defined($snapname) && $snap eq $snapname) &&
                !(defined($parent_snapname) && $snap eq $parent_snapname) &&
                $snap =~ m/^\Q$prefix\E/ &&
-               $last_sync != 0 # last_sync is 0 if the VM was stolen
+               $removal_ok
            ) {
                $logfunc->("delete stale replication snapshot '$snap' on $volid");
                eval {