Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 15 additions & 14 deletions sled-agent/src/opte/illumos/firewall_rules.rs
Original file line number Diff line number Diff line change
Expand Up @@ -24,38 +24,38 @@ use oxide_vpc::api::ProtoFilter;
use oxide_vpc::api::Protocol;

trait FromVpcFirewallRule {
fn action(self: &Self) -> Action;
fn direction(self: &Self) -> Direction;
fn disabled(self: &Self) -> bool;
fn hosts(self: &Self) -> Vec<Address>;
fn ports(self: &Self) -> Ports;
fn priority(self: &Self) -> u16;
fn protos(self: &Self) -> Vec<ProtoFilter>;
fn action(&self) -> Action;
fn direction(&self) -> Direction;
fn disabled(&self) -> bool;
fn hosts(&self) -> Vec<Address>;
fn ports(&self) -> Ports;
fn priority(&self) -> u16;
fn protos(&self) -> Vec<ProtoFilter>;
}

impl FromVpcFirewallRule for VpcFirewallRule {
fn action(self: &Self) -> Action {
fn action(&self) -> Action {
match self.action {
VpcFirewallRuleAction::Allow => Action::Allow,
VpcFirewallRuleAction::Deny => Action::Deny,
}
}

fn direction(self: &Self) -> Direction {
fn direction(&self) -> Direction {
match self.direction {
VpcFirewallRuleDirection::Inbound => Direction::In,
VpcFirewallRuleDirection::Outbound => Direction::Out,
}
}

fn disabled(self: &Self) -> bool {
fn disabled(&self) -> bool {
match self.status {
VpcFirewallRuleStatus::Disabled => false,
VpcFirewallRuleStatus::Enabled => true,
}
}

fn hosts(self: &Self) -> Vec<Address> {
fn hosts(&self) -> Vec<Address> {
self.filter_hosts.as_ref().map_or_else(
|| vec![Address::Any],
|hosts| {
Expand All @@ -78,7 +78,7 @@ impl FromVpcFirewallRule for VpcFirewallRule {
)
}

fn ports(self: &Self) -> Ports {
fn ports(&self) -> Ports {
match self.filter_ports {
Some(ref ports) if ports.len() > 0 => Ports::PortList(
ports
Expand Down Expand Up @@ -125,6 +125,7 @@ pub fn opte_firewall_rules(
vni: &Vni,
mac: &MacAddr6,
) -> Vec<FirewallRule> {
#[allow(clippy::map_flatten)]
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Justification: the structure of this whole loop is that we accumulate a doubly nested vector of translated rules (one for each host and protocol) and then flatten it twice to get a single vector that covers everything. If we wrote the flattening as .flat_map(...).flatten() as suggested by clippy, it would totally obscure the structure of the loop. It seems correct to replace one level of .map(...).flatten() with .flat_map(...), but (at least in this case) not two.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds reasonable. I'd consider a comment explaining that (even if it's just "Clippy doesn't like .map(...).flatten() below, but in this case it's clearer than the alternative."). Up to you.

rules
.iter()
.filter(|rule| rule.disabled())
Expand Down Expand Up @@ -154,8 +155,8 @@ pub fn opte_firewall_rules(
filters: {
let mut filters = Filters::new();
filters
.set_hosts(hosts.clone())
.set_protocol(proto.clone())
.set_hosts(*hosts)
.set_protocol(*proto)
.set_ports(ports.clone());
filters
},
Expand Down