Update OPTE

.github/buildomat/jobs/deploy.sh

@@ -2,7 +2,7 @@
 #:
 #: name = "helios / deploy"
 #: variety = "basic"
-#: target = "lab-netdev"
+#: target = "lab-opte-0.19"
 #: output_rules = [
 #:	"%/var/svc/log/system-illumos-sled-agent:default.log",
 #:	"%/zone/oxz_nexus/root/var/svc/log/system-illumos-nexus:default.log",

Cargo.toml

@@ -169,15 +169,15 @@ omicron-package = { path = "package" }
 omicron-sled-agent = { path = "sled-agent" }
 omicron-test-utils = { path = "test-utils" }
 omicron-zone-package = "0.5.1"
-oxide-vpc = { git = "https://github.com/oxidecomputer/opte", rev = "23fdf5856f10f23e2d26865d2d7e2d3bc537bca3", features = [ "api", "std" ] }
+oxide-vpc = { git = "https://github.com/oxidecomputer/opte", rev = "f501445f5a6c275c79f08a876fff6a861df31d46", features = [ "api", "std" ] }
 once_cell = "1.17.0"
 openapi-lint = { git = "https://github.com/oxidecomputer/openapi-lint", branch = "main" }
 openapiv3 = "1.0"
 # must match samael's crate!
 openssl = "0.10"
 openssl-sys = "0.9"
 openssl-probe = "0.1.2"
-opte-ioctl = { git = "https://github.com/oxidecomputer/opte", rev = "23fdf5856f10f23e2d26865d2d7e2d3bc537bca3" }
+opte-ioctl = { git = "https://github.com/oxidecomputer/opte", rev = "f501445f5a6c275c79f08a876fff6a861df31d46" }
 oso = "0.26"
 oximeter = { path = "oximeter/oximeter" }
 oximeter-client = { path = "oximeter-client" }

nexus/defaults/src/lib.rs

@@ -58,16 +58,6 @@ lazy_static! {
                     "action": "allow",
                     "priority": 65534,
                     "description": "allow inbound ICMP traffic from anywhere"
-                },
-                {
-                    "name": "allow-rdp",
-                    "status": "enabled",
-                    "direction": "inbound",
-                    "targets": [ { "type": "vpc", "value": "default" } ],
-                    "filters": { "ports": [ "3389" ], "protocols": [ "TCP" ] },
-                    "action": "allow",
-                    "priority": 65534,
-                    "description": "allow inbound TCP connections on port 3389 from anywhere"
                 }
             ]
         }"#).unwrap();

nexus/tests/integration_tests/vpc_firewall.rs

@@ -234,33 +234,6 @@ fn is_default_firewall_rules(
             priority: VpcFirewallRulePriority(65534),
             vpc_id: Uuid::new_v4(),
         },
-        VpcFirewallRule {
-            identity: IdentityMetadata {
-                id: "dd166833-cd79-4279-beb0-186cadb982ce".parse().unwrap(),
-                name: "allow-rdp".parse().unwrap(),
-                description:
-                    "allow inbound TCP connections on port 3389 from anywhere"
-                        .to_string(),
-                time_created: "2021-11-16T00:24:06.027404Z".parse().unwrap(),
-                time_modified: "2021-11-16T00:24:06.027404Z".parse().unwrap(),
-            },
-            status: VpcFirewallRuleStatus::Enabled,
-            direction: VpcFirewallRuleDirection::Inbound,
-            targets: vec![VpcFirewallRuleTarget::Vpc(
-                vpc_name.parse().unwrap(),
-            )],
-            filters: VpcFirewallRuleFilter {
-                hosts: None,
-                protocols: Some(vec![VpcFirewallRuleProtocol::Tcp]),
-                ports: Some(vec![L4PortRange {
-                    first: L4Port::try_from(3389).unwrap(),
-                    last: L4Port::try_from(3389).unwrap(),
-                }]),
-            },
-            action: VpcFirewallRuleAction::Allow,
-            priority: VpcFirewallRulePriority(65534),
-            vpc_id: Uuid::new_v4(),
-        },
         VpcFirewallRule {
             identity: IdentityMetadata {
                 id: "4cb76726-4cb6-4bc2-8d32-71c36e3881d4".parse().unwrap(),

sled-agent/src/opte/illumos/firewall_rules.rs

@@ -12,10 +12,10 @@ use omicron_common::api::external::VpcFirewallRuleAction;
 use omicron_common::api::external::VpcFirewallRuleDirection;
 use omicron_common::api::external::VpcFirewallRuleProtocol;
 use omicron_common::api::external::VpcFirewallRuleStatus;
-use oxide_vpc::api::Action;
 use oxide_vpc::api::Address;
 use oxide_vpc::api::Direction;
 use oxide_vpc::api::Filters;
+use oxide_vpc::api::FirewallAction;
 use oxide_vpc::api::FirewallRule;
 use oxide_vpc::api::Ipv4Cidr;
 use oxide_vpc::api::Ipv4PrefixLen;
@@ -24,7 +24,7 @@ use oxide_vpc::api::ProtoFilter;
 use oxide_vpc::api::Protocol;
 
 trait FromVpcFirewallRule {
-    fn action(&self) -> Action;
+    fn action(&self) -> FirewallAction;
     fn direction(&self) -> Direction;
     fn disabled(&self) -> bool;
     fn hosts(&self) -> Vec<Address>;
@@ -34,10 +34,10 @@ trait FromVpcFirewallRule {
 }
 
 impl FromVpcFirewallRule for VpcFirewallRule {
-    fn action(&self) -> Action {
+    fn action(&self) -> FirewallAction {
         match self.action {
-            VpcFirewallRuleAction::Allow => Action::Allow,
-            VpcFirewallRuleAction::Deny => Action::Deny,
+            VpcFirewallRuleAction::Allow => FirewallAction::Allow,
+            VpcFirewallRuleAction::Deny => FirewallAction::Deny,
         }
     }
 

sled-agent/src/opte/illumos/port_manager.rs

@@ -278,7 +278,7 @@ impl PortManager {
                 snat,
                 external_ips: external_ip,
             }),
-            private_mac: MacAddr::from(mac.into_array()),
+            guest_mac: MacAddr::from(mac.into_array()),
             gateway_mac: MacAddr::from(gateway.mac.into_array()),
             vni,
             phys_ip: self.inner.underlay_ip.into(),
@@ -302,7 +302,16 @@ impl PortManager {
         );
 
         // Initialize firewall rules for the new port.
-        let rules = opte_firewall_rules(firewall_rules, &vni, &mac);
+        let mut rules = opte_firewall_rules(firewall_rules, &vni, &mac);
+
+        // TODO-remove: This is part of the external IP hack.
+        //
+        // We need to allow incoming ARP packets past the firewall layer so
+        // that they may be handled properly at the gateway layer.
+        rules.push(
+            "dir=in priority=65534 protocol=arp action=allow".parse().unwrap(),
+        );
+
         debug!(
             self.inner.log,
             "Setting firewall rules";

tools/install_opte.sh

@@ -122,7 +122,7 @@ function add_publisher {
 # `helios-netdev` provides the xde kernel driver and the `opteadm` userland tool
 # for interacting with it.
 HELIOS_NETDEV_BASE_URL="https://buildomat.eng.oxide.computer/public/file/oxidecomputer/opte/repo"
-HELIOS_NETDEV_COMMIT="23fdf5856f10f23e2d26865d2d7e2d3bc537bca3"
+HELIOS_NETDEV_COMMIT="f501445f5a6c275c79f08a876fff6a861df31d46"
 HELIOS_NETDEV_REPO_URL="$HELIOS_NETDEV_BASE_URL/$HELIOS_NETDEV_COMMIT/opte.p5p"
 HELIOS_NETDEV_REPO_SHA_URL="$HELIOS_NETDEV_BASE_URL/$HELIOS_NETDEV_COMMIT/opte.p5p.sha256"
 HELIOS_NETDEV_REPO_PATH="$XDE_DIR/$(basename "$HELIOS_NETDEV_REPO_URL")"