public inbox for pve-devel@lists.proxmox.com
 help / color / mirror / Atom feed
From: Wolfgang Bumiller <w.bumiller@proxmox.com>
To: Stefan Hanreich <s.hanreich@proxmox.com>
Cc: pve-devel@lists.proxmox.com
Subject: Re: [pve-devel] [PATCH proxmox-ve-rs v2 14/25] sdn: ipam: add method for generating ipsets
Date: Wed, 6 Nov 2024 16:12:44 +0100	[thread overview]
Message-ID: <rkxsc5ghxiy2zkn4xbgqlpqltvwtenchwyktxmnsgc6pvzdgup@a7vktakajqa3> (raw)
In-Reply-To: <20241010155637.255451-15-s.hanreich@proxmox.com>

On Thu, Oct 10, 2024 at 05:56:26PM GMT, Stefan Hanreich wrote:
> For every guest that has at least one entry in the IPAM we generate an
> ipset with the name `+sdn/guest-ipam-{vmid}`. The ipset contains all
> IPs from all zones for a guest with {vmid}.
> 
> Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
> ---
>  .../src/firewall/types/address.rs             |  9 ++++
>  proxmox-ve-config/src/sdn/ipam.rs             | 54 ++++++++++++++++++-
>  2 files changed, 62 insertions(+), 1 deletion(-)
> 
> diff --git a/proxmox-ve-config/src/firewall/types/address.rs b/proxmox-ve-config/src/firewall/types/address.rs
> index a7bb6ad..e5a3709 100644
> --- a/proxmox-ve-config/src/firewall/types/address.rs
> +++ b/proxmox-ve-config/src/firewall/types/address.rs
> @@ -108,6 +108,15 @@ impl From<Ipv6Cidr> for Cidr {
>      }
>  }
>  
> +impl From<IpAddr> for Cidr {
> +    fn from(value: IpAddr) -> Self {
> +        match value {
> +            IpAddr::V4(addr) => Ipv4Cidr::from(addr).into(),
> +            IpAddr::V6(addr) => Ipv6Cidr::from(addr).into(),
> +        }
> +    }
> +}
> +
>  const IPV4_LENGTH: u8 = 32;
>  
>  #[derive(Clone, Copy, Debug, PartialOrd, Ord, PartialEq, Eq, Hash)]
> diff --git a/proxmox-ve-config/src/sdn/ipam.rs b/proxmox-ve-config/src/sdn/ipam.rs
> index 682bbe7..075c0f3 100644
> --- a/proxmox-ve-config/src/sdn/ipam.rs
> +++ b/proxmox-ve-config/src/sdn/ipam.rs
> @@ -8,7 +8,11 @@ use std::{
>  use serde::Deserialize;
>  
>  use crate::{
> -    firewall::types::Cidr,
> +    common::Allowlist,
> +    firewall::types::{
> +        ipset::{IpsetEntry, IpsetScope},
> +        Cidr, Ipset,
> +    },
>      guest::{types::Vmid, vm::MacAddress},
>      sdn::{SdnNameError, SubnetName, ZoneName},
>  };
> @@ -309,6 +313,54 @@ impl Ipam {
>      }
>  }
>  
> +impl Ipam {
> +    /// generates an [`Ipset`] for all guests with at least one entry in the IPAM
> +    ///
> +    /// # Arguments
> +    /// * `filter` - A [`Allowlist<Vmid>`] for which IPsets should get returned
> +    ///
> +    /// It contains all IPs in all VNets, that a guest has stored in IPAM.
> +    /// Ipset name is of the form `guest-ipam-<vmid>`
> +    pub fn ipsets<'a>(
> +        &self,
> +        filter: impl Into<Option<&'a Allowlist<Vmid>>>,

^ Why the `impl Into`? All our current uses should work for just the
Option directly (and then we can also drop the named lifetime).

> +    ) -> impl Iterator<Item = Ipset> + '_ {
> +        let filter = filter.into();
> +
> +        self.entries
> +            .iter()
> +            .flat_map(|(_, entries)| entries.iter())
> +            .filter_map(|entry| {
> +                if let IpamData::Vm(data) = &entry.data() {
> +                    if filter
> +                        .map(|list| list.is_allowed(&data.vmid))
> +                        .unwrap_or(true)

Let's bump MSRV to 1.82 and use

    if filter.is_none_or(|list| list.is_allowed(&data.vmid)) {

? :)

> +                    {
> +                        return Some(data);
> +                    }
> +                }
> +
> +                None
> +            })
> +            .fold(HashMap::<Vmid, Ipset>::new(), |mut acc, entry| {
> +                match acc.get_mut(&entry.vmid) {
> +                    Some(ipset) => {
> +                        ipset.push(IpsetEntry::from(entry.ip));
> +                    }
> +                    None => {
> +                        let ipset_name = format!("guest-ipam-{}", entry.vmid);
> +                        let mut ipset = Ipset::from_parts(IpsetScope::Sdn, ipset_name);
> +                        ipset.push(IpsetEntry::from(entry.ip));
> +                        acc.insert(entry.vmid, ipset);
> +                    }
> +                };

Mhhhh. The `ipset.upsh()` is identical in both cases, and vmid is a
simple Copy type, so we could use the entry api for this:

    acc.entry(entry.vmid)
        .or_insert_with(|| {
            Ipset::from_parts(IpsetScope::Sdn, format!("guest-ipam-{}", entry.vmid))
        })
        .push(IpsetEntry::from(entry.ip));

> +
> +                acc
> +            })
> +            .into_values()
> +    }
> +}
> +
>  impl TryFrom<IpamJson> for Ipam {
>      type Error = IpamError;
>  
> -- 
> 2.39.5



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel


  reply	other threads:[~2024-11-06 15:13 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-10-10 15:56 [pve-devel] [PATCH docs/firewall/manager/proxmox{-ve-rs, -firewall, -perl-rs} v2 00/25] autogenerate ipsets for sdn objects Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 01/25] debian: add files for packaging Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 02/25] bump serde_with to 3 Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 03/25] bump dependencies Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 04/25] firewall: add sdn scope for ipsets Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 05/25] firewall: add ip range types Stefan Hanreich
2024-11-06 13:13   ` Wolfgang Bumiller
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 06/25] firewall: address: use new iprange type for ip entries Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 07/25] ipset: add range variant to addresses Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 08/25] iprange: add methods for converting an ip range to cidrs Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 09/25] ipset: address: add helper methods Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 10/25] firewall: guest: derive traits according to rust api guidelines Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 11/25] common: add allowlist Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 12/25] sdn: add name types Stefan Hanreich
2024-11-06 14:18   ` Wolfgang Bumiller
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 13/25] sdn: add ipam module Stefan Hanreich
2024-11-06 14:52   ` Wolfgang Bumiller
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 14/25] sdn: ipam: add method for generating ipsets Stefan Hanreich
2024-11-06 15:12   ` Wolfgang Bumiller [this message]
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 15/25] sdn: add config module Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 16/25] sdn: config: add method for generating ipsets Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 17/25] tests: add sdn config tests Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 18/25] tests: add ipam tests Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-firewall v2 19/25] config: tests: add support for loading sdn and ipam config Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-firewall v2 20/25] ipsets: autogenerate ipsets for vnets and ipam Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH pve-firewall v2 21/25] add support for loading sdn firewall configuration Stefan Hanreich
2024-11-07 10:44   ` Wolfgang Bumiller
2024-10-10 15:56 ` [pve-devel] [PATCH pve-firewall v2 22/25] api: load sdn ipsets Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-perl-rs v2 23/25] add PVE::RS::Firewall::SDN module Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH pve-manager v2 24/25] firewall: add sdn scope to IPRefSelector Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH pve-docs v2 25/25] sdn: add documentation for firewall integration Stefan Hanreich

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=rkxsc5ghxiy2zkn4xbgqlpqltvwtenchwyktxmnsgc6pvzdgup@a7vktakajqa3 \
    --to=w.bumiller@proxmox.com \
    --cc=pve-devel@lists.proxmox.com \
    --cc=s.hanreich@proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal