Plumb firewall rules

common/src/api/external/mod.rs

@@ -1005,33 +1005,11 @@ impl JsonSchema for Ipv4Net {
             })),
             instance_type: Some(schemars::schema::InstanceType::String.into()),
             string: Some(Box::new(schemars::schema::StringValidation {
-                // Addresses must be from an RFC 1918 private address space
                 pattern: Some(
                     concat!(
-                        r#"^("#,
-                        // 10.0.0.0/8 (10.0.0.0 .. 10.255.255.255)
-                        r#"10\."#,
+                        r#"^(([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}"#,
                         r#"([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])"#,
-                        r#"\."#,
-                        r#"([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])"#,
-                        r#"\."#,
-                        r#"([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])"#,
-                        r#"\/([8-9]|1[0-9]|2[0-9]|3[0-2])|"#,
-                        // 172.16.0.0/12 (172.16.0.0 .. 172.31.255.255)
-                        r#"172\."#,
-                        r#"(1[6-9]|2[0-9]|3[0-1])"#,
-                        r#"\."#,
-                        r#"([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])"#,
-                        r#"\."#,
-                        r#"([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])"#,
-                        r#"\/(1[2-9]|2[0-9]|3[0-2])|"#,
-                        // 192.168.0.0/16 (192.168.0.0 .. 192.168.255.255)
-                        r#"192\.168\."#,
-                        r#"([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])"#,
-                        r#"\."#,
-                        r#"([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])"#,
-                        r#"\/(1[6-9]|2[0-9]|3[0-2])"#,
-                        r#")$"#,
+                        r#"/([8-9]|1[0-9]|2[0-9]|3[0-2])$"#,
                     )
                     .to_string(),
                 ),

nexus/db-model/src/name.rs

@@ -22,6 +22,7 @@ use serde::{Deserialize, Serialize};
     AsExpression,
     FromSqlRow,
     Eq,
+    Hash,
     PartialEq,
     Ord,
     PartialOrd,

nexus/src/app/instance.rs

@@ -30,6 +30,7 @@ use omicron_common::api::external::InternalContext;
 use omicron_common::api::external::ListResultVec;
 use omicron_common::api::external::LookupResult;
 use omicron_common::api::external::UpdateResult;
+use omicron_common::api::external::Vni;
 use omicron_common::api::internal::nexus;
 use sled_agent_client::types::InstanceRuntimeStateMigrateParams;
 use sled_agent_client::types::InstanceRuntimeStateRequested;
@@ -556,6 +557,32 @@ impl super::Nexus {
         let source_nat =
             SourceNatConfig::from(snat_ip.into_iter().next().unwrap());
 
+        // Gather the firewall rules for the VPC this instance is in.
+        // The NIC info we gathered above doesn't have VPC information
+        // because the sled agent doesn't care about that directly,
+        // so we fetch it via the first interface's VNI. (It doesn't
+        // matter which one we use because all NICs must be in the
+        // same VPC; see the check in project_create_instance.)
+        let firewall_rules = if let Some(nic) = nics.first() {
+            let vni = Vni::try_from(nic.vni.0)?;
+            let vpc = self
+                .db_datastore
+                .resolve_vni_to_vpc(opctx, db::model::Vni(vni))
+                .await?;
+            let (.., authz_vpc) = LookupPath::new(opctx, &self.db_datastore)
+                .vpc_id(vpc.id())
+                .lookup_for(authz::Action::Read)
+                .await?;
+            let rules = self
+                .db_datastore
+                .vpc_list_firewall_rules(opctx, &authz_vpc)
+                .await?;
+            self.resolve_firewall_rules_for_sled_agent(opctx, &vpc, &rules)
+                .await?
+        } else {
+            vec![]
+        };
+
         // Gather the SSH public keys of the actor make the request so
         // that they may be injected into the new image via cloud-init.
         // TODO-security: this should be replaced with a lookup based on
@@ -596,6 +623,7 @@ impl super::Nexus {
             nics,
             source_nat,
             external_ips,
+            firewall_rules,
             disks: disk_reqs,
             cloud_init_bytes: Some(base64::encode(
                 db_instance.generate_cidata(&public_keys)?,

nexus/src/app/sagas/instance_migrate.rs

@@ -221,12 +221,16 @@ async fn sim_instance_migrate(
     }
     let source_nat = SourceNatConfig::from(snat_ip.into_iter().next().unwrap());
 
+    // The TODOs below are tracked in
+    //   https://github.com/oxidecomputer/omicron/issues/1783
     let instance_hardware = InstanceHardware {
         runtime: runtime.into(),
         // TODO: populate NICs
         nics: vec![],
         source_nat,
         external_ips,
+        // TODO: populate firewall rules
+        firewall_rules: vec![],
         // TODO: populate disks
         disks: vec![],
         // TODO: populate cloud init bytes