merge main into multicast-e2e

Author: zeeshanlakhani

Cargo.lock

@@ -270,6 +270,7 @@ impl From<omicron_common::api::external::VpcFirewallRuleProtocol>
             Tcp => Self::Tcp,
             Udp => Self::Udp,
             Icmp(v) => Self::Icmp(v),
+            Icmp6(v) => Self::Icmp6(v),
         }
     }
 }

clients/sled-agent-client/src/lib.rs

@@ -1877,16 +1877,35 @@ pub enum VpcFirewallRuleProtocol {
     Tcp,
     Udp,
     Icmp(Option<VpcFirewallIcmpFilter>),
-    // TODO: IPv6 not supported by instances.
-    // Icmpv6(Option<VpcFirewallIcmpFilter>),
+    Icmp6(Option<VpcFirewallIcmpFilter>),
     // TODO: OPTE does not yet permit further L4 protocols. (opte#609)
     // Other(u16),
 }
 
-impl FromStr for VpcFirewallRuleProtocol {
-    type Err = Error;
+impl VpcFirewallRuleProtocol {
+    /// Returns a string representation of this protocol filter suitable for
+    /// use as an API string or in the database.
+    ///
+    /// This is the inverse of `from_api_string`.
+    pub fn to_api_string(&self) -> String {
+        match self {
+            VpcFirewallRuleProtocol::Tcp => "tcp".to_string(),
+            VpcFirewallRuleProtocol::Udp => "udp".to_string(),
+            VpcFirewallRuleProtocol::Icmp(None) => "icmp".to_string(),
+            VpcFirewallRuleProtocol::Icmp(Some(v)) => {
+                format!("icmp:{}", v.to_api_string())
+            }
+            VpcFirewallRuleProtocol::Icmp6(None) => "icmp6".to_string(),
+            VpcFirewallRuleProtocol::Icmp6(Some(v)) => {
+                format!("icmp6:{}", v.to_api_string())
+            }
+        }
+    }
 
-    fn from_str(proto: &str) -> Result<Self, Self::Err> {
+    /// Parses a protocol filter from the API string format.
+    ///
+    /// This is the inverse of `to_api_string`.
+    pub fn from_api_string(proto: &str) -> Result<Self, Error> {
         let (ty_str, content_str) = match proto.split_once(':') {
             None => (proto, None),
             Some((lhs, rhs)) => (lhs, Some(rhs)),
@@ -1898,9 +1917,15 @@ impl FromStr for VpcFirewallRuleProtocol {
             (lhs, None) if lhs.eq_ignore_ascii_case("icmp") => {
                 Ok(Self::Icmp(None))
             }
-            (lhs, Some(rhs)) if lhs.eq_ignore_ascii_case("icmp") => {
-                Ok(Self::Icmp(Some(rhs.parse()?)))
+            (lhs, Some(rhs)) if lhs.eq_ignore_ascii_case("icmp") => Ok(
+                Self::Icmp(Some(VpcFirewallIcmpFilter::from_api_string(rhs)?)),
+            ),
+            (lhs, None) if lhs.eq_ignore_ascii_case("icmp6") => {
+                Ok(Self::Icmp6(None))
             }
+            (lhs, Some(rhs)) if lhs.eq_ignore_ascii_case("icmp6") => Ok(
+                Self::Icmp6(Some(VpcFirewallIcmpFilter::from_api_string(rhs)?)),
+            ),
             (lhs, None) => Err(Error::invalid_value(
                 "vpc_firewall_rule_protocol",
                 format!("unrecognized protocol: {lhs}"),
@@ -1915,45 +1940,28 @@ impl FromStr for VpcFirewallRuleProtocol {
     }
 }
 
-impl TryFrom<String> for VpcFirewallRuleProtocol {
-    type Error = <VpcFirewallRuleProtocol as FromStr>::Err;
-
-    fn try_from(proto: String) -> Result<Self, Self::Error> {
-        proto.parse()
-    }
-}
-
-impl Display for VpcFirewallRuleProtocol {
-    fn fmt(&self, f: &mut Formatter<'_>) -> FormatResult {
-        match self {
-            VpcFirewallRuleProtocol::Tcp => write!(f, "tcp"),
-            VpcFirewallRuleProtocol::Udp => write!(f, "udp"),
-            VpcFirewallRuleProtocol::Icmp(None) => write!(f, "icmp"),
-            VpcFirewallRuleProtocol::Icmp(Some(v)) => write!(f, "icmp:{v}"),
-        }
-    }
-}
-
 #[derive(Clone, Copy, Debug, PartialEq, Deserialize, Serialize, JsonSchema)]
 pub struct VpcFirewallIcmpFilter {
     pub icmp_type: u8,
     pub code: Option<IcmpParamRange>,
 }
 
-impl Display for VpcFirewallIcmpFilter {
-    fn fmt(&self, f: &mut Formatter<'_>) -> FormatResult {
-        write!(f, "{}", self.icmp_type)?;
-        if let Some(code) = self.code {
-            write!(f, ",{code}")?;
+impl VpcFirewallIcmpFilter {
+    /// Returns a string representation of this ICMP filter suitable for use
+    /// as part of an API string or in the database.
+    ///
+    /// This is the inverse of `from_api_string`.
+    pub fn to_api_string(&self) -> String {
+        match self.code {
+            None => self.icmp_type.to_string(),
+            Some(code) => format!("{},{code}", self.icmp_type),
         }
-        Ok(())
     }
-}
-
-impl FromStr for VpcFirewallIcmpFilter {
-    type Err = Error;
 
-    fn from_str(filter: &str) -> Result<Self, Self::Err> {
+    /// Parses an ICMP filter from the API string format.
+    ///
+    /// This is the inverse of `to_api_string`.
+    pub fn from_api_string(filter: &str) -> Result<Self, Error> {
         let (ty_str, code_str) = match filter.split_once(',') {
             None => (filter, None),
             Some((lhs, rhs)) => (lhs, Some(rhs)),
@@ -3927,72 +3935,78 @@ mod test {
     }
 
     #[test]
-    fn test_firewall_rule_proto_filter_parse() {
-        assert_eq!(VpcFirewallRuleProtocol::Tcp, "tcp".parse().unwrap());
-        assert_eq!(VpcFirewallRuleProtocol::Udp, "udp".parse().unwrap());
+    fn test_firewall_rule_proto_filter_from_api_string() {
+        assert_eq!(
+            VpcFirewallRuleProtocol::Tcp,
+            VpcFirewallRuleProtocol::from_api_string("tcp").unwrap()
+        );
+        assert_eq!(
+            VpcFirewallRuleProtocol::Udp,
+            VpcFirewallRuleProtocol::from_api_string("udp").unwrap()
+        );
 
         assert_eq!(
             VpcFirewallRuleProtocol::Icmp(None),
-            "icmp".parse().unwrap()
+            VpcFirewallRuleProtocol::from_api_string("icmp").unwrap()
         );
         assert_eq!(
             VpcFirewallRuleProtocol::Icmp(Some(VpcFirewallIcmpFilter {
                 icmp_type: 4,
                 code: None
             })),
-            "icmp:4".parse().unwrap()
+            VpcFirewallRuleProtocol::from_api_string("icmp:4").unwrap()
         );
         assert_eq!(
             VpcFirewallRuleProtocol::Icmp(Some(VpcFirewallIcmpFilter {
                 icmp_type: 60,
                 code: Some(0.into())
             })),
-            "icmp:60,0".parse().unwrap()
+            VpcFirewallRuleProtocol::from_api_string("icmp:60,0").unwrap()
         );
         assert_eq!(
             VpcFirewallRuleProtocol::Icmp(Some(VpcFirewallIcmpFilter {
                 icmp_type: 60,
                 code: Some((0..=10).try_into().unwrap())
             })),
-            "icmp:60,0-10".parse().unwrap()
+            VpcFirewallRuleProtocol::from_api_string("icmp:60,0-10").unwrap()
         );
         assert_eq!(
-            "icmp:".parse::<VpcFirewallRuleProtocol>(),
+            VpcFirewallRuleProtocol::from_api_string("icmp:"),
             Err(Error::invalid_value(
                 "icmp_type",
                 "\"\" unparsable for type: cannot parse integer from empty string"
             ))
         );
         assert_eq!(
-            "icmp:20-30".parse::<VpcFirewallRuleProtocol>(),
+            VpcFirewallRuleProtocol::from_api_string("icmp:20-30"),
             Err(Error::invalid_value(
                 "icmp_type",
                 "\"20-30\" unparsable for type: invalid digit found in string"
             ))
         );
         assert_eq!(
-            "icmp:10,".parse::<VpcFirewallRuleProtocol>(),
+            VpcFirewallRuleProtocol::from_api_string("icmp:10,"),
             Err(Error::invalid_value(
                 "code",
                 "\"\" unparsable for type: cannot parse integer from empty string"
             ))
         );
         assert_eq!(
-            "icmp:257,".parse::<VpcFirewallRuleProtocol>(),
+            VpcFirewallRuleProtocol::from_api_string("icmp:257,"),
             Err(Error::invalid_value(
                 "icmp_type",
                 "\"257\" unparsable for type: number too large to fit in target type"
             ))
         );
         assert_eq!(
-            "icmp:0,1000-1001".parse::<VpcFirewallRuleProtocol>(),
+            VpcFirewallRuleProtocol::from_api_string("icmp:0,1000-1001"),
             Err(Error::invalid_value(
                 "code",
                 "\"1000\" unparsable for type: number too large to fit in target type"
             ))
         );
         assert_eq!(
-            "icmp:0,30-".parse::<VpcFirewallRuleProtocol>(),
+            VpcFirewallRuleProtocol::from_api_string("icmp:0,30-"),
             Err(Error::invalid_value("code", "range has no end value"))
         );
     }

common/src/api/external/mod.rs

@@ -112,6 +112,7 @@ use nexus_db_model::VolumeResourceUsage;
 use nexus_db_model::VpcSubnet;
 use nexus_db_model::Zpool;
 use nexus_db_model::to_db_typed_uuid;
+use nexus_db_queries::authz;
 use nexus_db_queries::context::OpContext;
 use nexus_db_queries::db;
 use nexus_db_queries::db::DataStore;
@@ -8188,8 +8189,9 @@ async fn cmd_db_trust_quorum_list_configs(
     }
 
     let limit = fetch_opts.fetch_limit;
+    let authz_tq = authz::TrustQuorumConfig::for_rack_id(args.rack_id);
     let configs = datastore
-        .tq_list_config(opctx, args.rack_id, &first_page::<i64>(limit))
+        .tq_list_config(opctx, authz_tq, &first_page::<i64>(limit))
         .await
         .context("listing trust quorum configurations")?;
 

dev-tools/omdb/src/bin/omdb/db.rs

@@ -110,6 +110,14 @@ impl FromVpcFirewallRule for ResolvedVpcFirewallRule {
                             }
                         }))
                     }
+                    VpcFirewallRuleProtocol::Icmp6(v) => {
+                        ProtoFilter::Icmpv6(v.map(|v| {
+                            oxide_vpc::api::IcmpFilter {
+                                ty: v.icmp_type,
+                                codes: v.code.map(Into::into),
+                            }
+                        }))
+                    }
                 })
                 .collect(),
             _ => vec![ProtoFilter::Any],

illumos-utils/src/opte/firewall_rules.rs

@@ -1129,6 +1129,40 @@ pub struct DatasetVolumeDeleteArgs<'a> {
     pub raw: bool,
 }
 
+/// Error returned by [`Zfs::remove_reservation`].
+#[derive(thiserror::Error, Debug)]
+#[error("Failed to remove reservation from '{name}': {err}")]
+pub struct RemoveReservationError {
+    name: String,
+    #[source]
+    err: RemoveReservationErrorInner,
+}
+
+impl RemoveReservationError {
+    pub fn get_value(name: String, err: GetValueError) -> Self {
+        RemoveReservationError {
+            name,
+            err: RemoveReservationErrorInner::GetValue(err),
+        }
+    }
+
+    pub fn set_value(name: String, err: SetValueError) -> Self {
+        RemoveReservationError {
+            name,
+            err: RemoveReservationErrorInner::SetValue(err),
+        }
+    }
+}
+
+#[derive(thiserror::Error, Debug)]
+pub enum RemoveReservationErrorInner {
+    #[error(transparent)]
+    GetValue(#[from] GetValueError),
+
+    #[error(transparent)]
+    SetValue(#[from] SetValueError),
+}
+
 impl Zfs {
     /// Lists all datasets within a pool or existing dataset.
     ///
@@ -2128,6 +2162,23 @@ impl Zfs {
             }
         }
     }
+
+    /// Remove a dataset's reservation, if set
+    pub async fn remove_reservation(
+        name: &str,
+    ) -> Result<(), RemoveReservationError> {
+        let value = Zfs::get_value(name, "reservation").await.map_err(|e| {
+            RemoveReservationError::get_value(name.to_string(), e)
+        })?;
+
+        if value != "none" {
+            Zfs::set_value(name, "reservation", "none").await.map_err(|e| {
+                RemoveReservationError::set_value(name.to_string(), e)
+            })?;
+        }
+
+        Ok(())
+    }
 }
 
 /// A read-only snapshot of a ZFS filesystem.