From: Wolfgang Bumiller <w.bumiller@proxmox.com>
To: Stefan Hanreich <s.hanreich@proxmox.com>
Cc: pve-devel@lists.proxmox.com
Subject: Re: [pve-devel] [PATCH proxmox-ve-rs v2 14/25] sdn: ipam: add method for generating ipsets
Date: Wed, 6 Nov 2024 16:12:44 +0100 [thread overview]
Message-ID: <rkxsc5ghxiy2zkn4xbgqlpqltvwtenchwyktxmnsgc6pvzdgup@a7vktakajqa3> (raw)
In-Reply-To: <20241010155637.255451-15-s.hanreich@proxmox.com>
On Thu, Oct 10, 2024 at 05:56:26PM GMT, Stefan Hanreich wrote:
> For every guest that has at least one entry in the IPAM we generate an
> ipset with the name `+sdn/guest-ipam-{vmid}`. The ipset contains all
> IPs from all zones for a guest with {vmid}.
>
> Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
> ---
> .../src/firewall/types/address.rs | 9 ++++
> proxmox-ve-config/src/sdn/ipam.rs | 54 ++++++++++++++++++-
> 2 files changed, 62 insertions(+), 1 deletion(-)
>
> diff --git a/proxmox-ve-config/src/firewall/types/address.rs b/proxmox-ve-config/src/firewall/types/address.rs
> index a7bb6ad..e5a3709 100644
> --- a/proxmox-ve-config/src/firewall/types/address.rs
> +++ b/proxmox-ve-config/src/firewall/types/address.rs
> @@ -108,6 +108,15 @@ impl From<Ipv6Cidr> for Cidr {
> }
> }
>
> +impl From<IpAddr> for Cidr {
> + fn from(value: IpAddr) -> Self {
> + match value {
> + IpAddr::V4(addr) => Ipv4Cidr::from(addr).into(),
> + IpAddr::V6(addr) => Ipv6Cidr::from(addr).into(),
> + }
> + }
> +}
> +
> const IPV4_LENGTH: u8 = 32;
>
> #[derive(Clone, Copy, Debug, PartialOrd, Ord, PartialEq, Eq, Hash)]
> diff --git a/proxmox-ve-config/src/sdn/ipam.rs b/proxmox-ve-config/src/sdn/ipam.rs
> index 682bbe7..075c0f3 100644
> --- a/proxmox-ve-config/src/sdn/ipam.rs
> +++ b/proxmox-ve-config/src/sdn/ipam.rs
> @@ -8,7 +8,11 @@ use std::{
> use serde::Deserialize;
>
> use crate::{
> - firewall::types::Cidr,
> + common::Allowlist,
> + firewall::types::{
> + ipset::{IpsetEntry, IpsetScope},
> + Cidr, Ipset,
> + },
> guest::{types::Vmid, vm::MacAddress},
> sdn::{SdnNameError, SubnetName, ZoneName},
> };
> @@ -309,6 +313,54 @@ impl Ipam {
> }
> }
>
> +impl Ipam {
> + /// generates an [`Ipset`] for all guests with at least one entry in the IPAM
> + ///
> + /// # Arguments
> + /// * `filter` - A [`Allowlist<Vmid>`] for which IPsets should get returned
> + ///
> + /// It contains all IPs in all VNets, that a guest has stored in IPAM.
> + /// Ipset name is of the form `guest-ipam-<vmid>`
> + pub fn ipsets<'a>(
> + &self,
> + filter: impl Into<Option<&'a Allowlist<Vmid>>>,
^ Why the `impl Into`? All our current uses should work for just the
Option directly (and then we can also drop the named lifetime).
> + ) -> impl Iterator<Item = Ipset> + '_ {
> + let filter = filter.into();
> +
> + self.entries
> + .iter()
> + .flat_map(|(_, entries)| entries.iter())
> + .filter_map(|entry| {
> + if let IpamData::Vm(data) = &entry.data() {
> + if filter
> + .map(|list| list.is_allowed(&data.vmid))
> + .unwrap_or(true)
Let's bump MSRV to 1.82 and use
if filter.is_none_or(|list| list.is_allowed(&data.vmid)) {
? :)
> + {
> + return Some(data);
> + }
> + }
> +
> + None
> + })
> + .fold(HashMap::<Vmid, Ipset>::new(), |mut acc, entry| {
> + match acc.get_mut(&entry.vmid) {
> + Some(ipset) => {
> + ipset.push(IpsetEntry::from(entry.ip));
> + }
> + None => {
> + let ipset_name = format!("guest-ipam-{}", entry.vmid);
> + let mut ipset = Ipset::from_parts(IpsetScope::Sdn, ipset_name);
> + ipset.push(IpsetEntry::from(entry.ip));
> + acc.insert(entry.vmid, ipset);
> + }
> + };
Mhhhh. The `ipset.upsh()` is identical in both cases, and vmid is a
simple Copy type, so we could use the entry api for this:
acc.entry(entry.vmid)
.or_insert_with(|| {
Ipset::from_parts(IpsetScope::Sdn, format!("guest-ipam-{}", entry.vmid))
})
.push(IpsetEntry::from(entry.ip));
> +
> + acc
> + })
> + .into_values()
> + }
> +}
> +
> impl TryFrom<IpamJson> for Ipam {
> type Error = IpamError;
>
> --
> 2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
next prev parent reply other threads:[~2024-11-06 15:13 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-10-10 15:56 [pve-devel] [PATCH docs/firewall/manager/proxmox{-ve-rs, -firewall, -perl-rs} v2 00/25] autogenerate ipsets for sdn objects Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 01/25] debian: add files for packaging Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 02/25] bump serde_with to 3 Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 03/25] bump dependencies Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 04/25] firewall: add sdn scope for ipsets Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 05/25] firewall: add ip range types Stefan Hanreich
2024-11-06 13:13 ` Wolfgang Bumiller
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 06/25] firewall: address: use new iprange type for ip entries Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 07/25] ipset: add range variant to addresses Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 08/25] iprange: add methods for converting an ip range to cidrs Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 09/25] ipset: address: add helper methods Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 10/25] firewall: guest: derive traits according to rust api guidelines Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 11/25] common: add allowlist Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 12/25] sdn: add name types Stefan Hanreich
2024-11-06 14:18 ` Wolfgang Bumiller
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 13/25] sdn: add ipam module Stefan Hanreich
2024-11-06 14:52 ` Wolfgang Bumiller
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 14/25] sdn: ipam: add method for generating ipsets Stefan Hanreich
2024-11-06 15:12 ` Wolfgang Bumiller [this message]
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 15/25] sdn: add config module Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 16/25] sdn: config: add method for generating ipsets Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 17/25] tests: add sdn config tests Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-ve-rs v2 18/25] tests: add ipam tests Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-firewall v2 19/25] config: tests: add support for loading sdn and ipam config Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-firewall v2 20/25] ipsets: autogenerate ipsets for vnets and ipam Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH pve-firewall v2 21/25] add support for loading sdn firewall configuration Stefan Hanreich
2024-11-07 10:44 ` Wolfgang Bumiller
2024-10-10 15:56 ` [pve-devel] [PATCH pve-firewall v2 22/25] api: load sdn ipsets Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH proxmox-perl-rs v2 23/25] add PVE::RS::Firewall::SDN module Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH pve-manager v2 24/25] firewall: add sdn scope to IPRefSelector Stefan Hanreich
2024-10-10 15:56 ` [pve-devel] [PATCH pve-docs v2 25/25] sdn: add documentation for firewall integration Stefan Hanreich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=rkxsc5ghxiy2zkn4xbgqlpqltvwtenchwyktxmnsgc6pvzdgup@a7vktakajqa3 \
--to=w.bumiller@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
--cc=s.hanreich@proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox