feat: Add storage management for VM creation and resizing

- Introduced storage parameter in VmCreateRequest and VmResizeRequest models.
- Implemented storage validation to ensure minimum and maximum limits.
- Enhanced CLI to support storage options during VM creation and resizing.
- Updated lifecycle management to handle pending resize operations for VM resources.
- Added methods for resizing VM disks and validating storage capacity.
- Updated API endpoints to accommodate new storage functionality.
- Refactored related validation and configuration logic to support storage management.

tests/test_firewall.py

@@ -102,9 +102,9 @@ class FakeRunner:
                     self.after_batch()
         elif args == ("conntrack", "--version"):
             stdout = "conntrack v1.4.8 (conntrack-tools)"
-        elif args[:2] == ("conntrack", "--delete"):
+        elif args[:2] == ("conntrack", "-D"):
             code = self.ct_delete_code
-        elif args[:2] == ("conntrack", "--list"):
+        elif args[:2] == ("conntrack", "-L"):
             stdout = self.ct_remaining
         else:
             raise AssertionError(f"unexpected command: {args}")
@@ -376,6 +376,34 @@ class FirewallManagerTests(unittest.TestCase):
             exprs[:-1] = reversed(exprs[:-1])
         self.assertEqual(self.manager.status(self.vm), "enforced")
 
+    def test_apply_accepts_nft_eliding_ethertype_from_the_ipv4_tcp_guard(self):
+        self.vm.ports = (PortRule(22),)
+
+        def elide_ethertype():
+            for item in self.policy():
+                expressions = item.get("rule", {}).get("expr", [])
+                if not any("&" in expr.get("match", {}).get("left", {}) for expr in expressions):
+                    continue
+                # nft 1.0.9 keeps ip protocol tcp to bind TCP to IPv4 in a
+                # bridge table, but omits its redundant ether type ip check.
+                expressions[:] = [expr for expr in expressions if expr != {
+                    "match": {"left": {"payload": {"protocol": "ether", "field": "type"}},
+                              "op": "==", "right": "ip"},
+                }]
+
+        self.runner.after_batch = elide_ethertype
+        self.manager.apply(self.vm)
+        self.assertEqual(self.manager.status(self.vm), "enforced")
+
+        # Losing BOTH IPv4 constraints is a real policy change, not formatting.
+        for item in self.policy():
+            expressions = item.get("rule", {}).get("expr", [])
+            if any("&" in expr.get("match", {}).get("left", {}) for expr in expressions):
+                expressions[:] = [expr for expr in expressions if expr.get("match", {}).get("left") != {
+                    "payload": {"protocol": "ip", "field": "protocol"},
+                }]
+        self.assertEqual(self.manager.status(self.vm), "drift")
+
     def test_empty_sets_can_omit_elements_and_missing_conditions_are_drift(self):
         self.vm.ports = ()
         self.manager.apply(self.vm)
@@ -430,7 +458,7 @@ class FirewallManagerTests(unittest.TestCase):
         self.runner.ct_delete_code = 1  # conntrack uses 1 for no matching entries too.
         self.manager.cleanup_connections(self.vm)
         for selector in ("--orig-src", "--orig-dst", "--reply-src", "--reply-dst"):
-            for command in ("--delete", "--list"):
+            for command in ("-D", "-L"):
                 self.assertIn(("conntrack", command, "--family", "ipv4", selector, self.vm.guest_ip),
                               [args for args, _ in self.runner.calls])
         self.assertFalse(any("--flush" in args or "-F" in args for args, _ in self.runner.calls))
@@ -438,7 +466,7 @@ class FirewallManagerTests(unittest.TestCase):
         with self.assertRaisesRegex(UvmError, "do not reuse"):
             self.manager.cleanup_connections(self.vm)
         self.runner.ct_remaining = ""
-        self.runner.fail_command = ("conntrack", "--list", "--family", "ipv4", "--orig-src", self.vm.guest_ip)
+        self.runner.fail_command = ("conntrack", "-L", "--family", "ipv4", "--orig-src", self.vm.guest_ip)
         with self.assertRaises(CommandError):
             self.manager.cleanup_connections(self.vm)
 
@@ -455,7 +483,7 @@ class FirewallManagerTests(unittest.TestCase):
                 expected = [("ip", "-j", "-d", "link", "show")]
                 expected.extend(("conntrack", command, "--family", "ipv4", field, "203.0.113.7")
                                 for field in ("--orig-src", "--orig-dst", "--reply-src", "--reply-dst")
-                                for command in ("--delete", "--list"))
+                                for command in ("-D", "-L"))
                 # No nft policy, publishing, or unrelated address/conntrack flush.
                 self.assertEqual([args for args, _ in self.runner.calls], expected)
 
@@ -476,7 +504,7 @@ class FirewallManagerTests(unittest.TestCase):
             with self.subTest(address=address, network=network):
                 self.runner.calls.clear()
                 self.manager.cleanup_connections(vm_record(guest_ip=address, network=network, ports=None))
-                deletes = [args for args, _ in self.runner.calls if args[:2] == ("conntrack", "--delete")]
+                deletes = [args for args, _ in self.runner.calls if args[:2] == ("conntrack", "-D")]
                 self.assertEqual(len(deletes), 4)
                 self.assertTrue(all(args[-1] == address for args in deletes))
 
@@ -688,6 +716,32 @@ class NftDumpFixtureTests(unittest.TestCase):
         self.assertEqual(self.normalize_rule(dumped), self.normalize_rule(numeric))
         self.assertNotEqual(self.normalize_rule(dumped), self.normalize_rule(numeric.replace('}}, 3]', '}}, 2]')))
 
+    def test_bridge_tcp_guard_normalizes_numeric_protocol_and_implicit_ethertype(self):
+        # nft 1.0.9 src/payload.c payload_may_dependency_kill() removes the
+        # EtherType before ip protocol, but retains ip protocol before TCP.
+        # Protocol and flag representations follow the upstream fixtures in
+        # tests/py/inet/ip_tcp.t.json.output and tests/py/inet/tcp.t.json.
+        dumped = '''[
+            {"match": {"left": {"payload": {"protocol": "ip", "field": "protocol"}},
+                       "op": "==", "right": 6}},
+            {"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": "new"}},
+            {"match": {"left": {"&": [
+                {"payload": {"protocol": "tcp", "field": "flags"}}, ["fin", "syn", "rst", "ack"]
+            ]}, "op": "!=", "right": "syn"}},
+            {"drop": null}
+        ]'''
+        policy = FirewallManager(Settings(), FakeRunner())._policy(vm_record(), quarantine=False)
+        guards = [item["rule"] for item in policy if "rule" in item
+                  and any("&" in expr.get("match", {}).get("left", {}) for expr in item["rule"]["expr"])]
+        self.assertEqual({rule["chain"] for rule in guards}, {"from_vm", "to_vm"})
+        for rule in guards:
+            with self.subTest(chain=rule["chain"]):
+                expected = self.normalize_rule(json.dumps(rule["expr"]))
+                self.assertEqual(expected, self.normalize_rule(dumped))
+                self.assertNotEqual(expected, self.normalize_rule(json.dumps(json.loads(dumped)[1:])))
+                self.assertNotEqual(expected, self.normalize_rule(dumped.replace('"right": 6', '"right": 17')))
+                self.assertNotEqual(expected, self.normalize_rule(dumped.replace('"op": "!="', '"op": "=="')))
+
     def test_upstream_full_dump_ignores_only_handles_and_metainfo(self):
         # Literal RULESET from tests/shell/testcases/json/0006obj_comment_0.
         dumped = json.loads('''{"nftables": [
@@ -706,6 +760,35 @@ class NftDumpFixtureTests(unittest.TestCase):
         self.assertNotEqual(_normalize(dumped), _normalize(expected))
 
 
+@unittest.skipUnless(shutil.which("conntrack"), "conntrack unavailable for nonmutating option checks")
+class ConntrackCommandParserTests(unittest.TestCase):
+    @staticmethod
+    def parse(command):
+        # An invalid final option aborts before any netlink operation, even
+        # when the tests run as root. This also checks delete command syntax.
+        return subprocess.run(
+            (*command, "--uvm-parser-sentinel"), text=True, capture_output=True,
+            timeout=5, env={**os.environ, "LC_ALL": "C"},
+        )
+
+    def test_cleanup_commands_reach_only_the_final_invalid_option(self):
+        runner = FakeRunner()
+        FirewallManager(Settings(), runner).cleanup_connections(vm_record())
+        commands = [args for args, _ in runner.calls if args[0] == "conntrack"]
+        self.assertEqual(len(commands), 8)
+        for command in commands:
+            with self.subTest(command=command):
+                result = self.parse(command)
+                self.assertEqual(result.returncode, 2, result.stderr)
+                self.assertRegex(result.stderr, r"(?:unknown|unrecognized) option [`']--uvm-parser-sentinel'")
+
+    def test_invalid_option_is_rejected_before_the_sentinel(self):
+        result = self.parse(("conntrack", "--uvm-invalid-option"))
+        self.assertEqual(result.returncode, 2)
+        self.assertIn("--uvm-invalid-option", result.stderr)
+        self.assertNotIn("--uvm-parser-sentinel", result.stderr)
+
+
 @unittest.skipUnless(shutil.which("nft"), "nft unavailable for noncommitting JSON parser checks")
 class NftJsonParserTests(unittest.TestCase):
     """Exercise the actual JSON parser, NOT semantic/kernel/packet validation.