Vpc firewall rule rendering needs update

[askfongjojo]

With the changes introduced in oxidecomputer/omicron#8194, the default rules inserted for any new VPC will need to include the new type field. Firewall rules GET API are currently failing because of this:

oxide --profile recovery vpc firewall-rules view --project angela --vpc default

error
Invalid Response Payload (b"{"rules":[{"id":"6f952a37-cd87-459e-bd6d-b5f75ddc7a7e","name":"allow-icmp","description":"allow inbound ICMP traffic from anywhere","time_created":"2025-07-10T01:54:42.298715Z","time_modified":"2025-07-10T01:54:42.298715Z","status":"enabled","direction":"inbound","targets":[{"type":"vpc","value":"default"}],"filters":{"hosts":null,"protocols":[{"type":"icmp","value":null}],"ports":null},"action":"allow","priority":65534,"vpc_id":"f9965440-9547-4546-ae37-d423418799ad"},{"id":"f7c1f8ab-fc7e-4441-ae8b-585b4d3dab1c","name":"allow-internal-inbound","description":"allow inbound traffic to all instances within the VPC if originated within the VPC","time_created":"2025-07-10T01:54:42.298711Z","time_modified":"2025-07-10T01:54:42.298711Z","status":"enabled","direction":"inbound","targets":[{"type":"vpc","value":"default"}],"filters":{"hosts":[{"type":"vpc","value":"default"}],"protocols":null,"ports":null},"action":"allow","priority":65534,"vpc_id":"f9965440-9547-4546-ae37-d423418799ad"},{"id":"6c73b5d8-379c-47da-9525-75ca8632fd0b","name":"allow-ssh","description":"allow inbound TCP connections on port 22 from anywhere","time_created":"2025-07-10T01:54:42.298714Z","time_modified":"2025-07-10T01:54:42.298714Z","status":"enabled","direction":"inbound","targets":[{"type":"vpc","value":"default"}],"filters":{"hosts":null,"protocols":[{"type":"tcp"}],"ports":["22"]},"action":"allow","priority":65534,"vpc_id":"f9965440-9547-4546-ae37-d423418799ad"}]}"): unknown variant type, expected one of TCP, UDP, ICMP at line 1 column 353: unknown variant type, expected one of TCP, UDP, ICMP at line 1 column 353

[FelixMcFelix]

This looks like an incompatible oxide.rs client -- Nexus is sending the new format and internally accounts for it. I've fixed up the automated OpenAPI update branch of oxide.rs to be compatible at https://github.com/oxidecomputer/oxide.rs/tree/felixmcfelix/integration:

kyle@KyleOxide oxide.rs % cargo r -r vpc firewall-rules view --project angela --vpc default
   Compiling oxide-cli v0.12.0+20250604.0.0 (/Users/kyle/gits/oxide.rs/cli)
    Finished `release` profile [optimized] target(s) in 31.99s
     Running `target/release/oxide vpc firewall-rules view --project angela --vpc default`
{
  "rules": [
    {
      "action": "allow",
      "description": "allow inbound ICMP traffic from anywhere",
      "direction": "inbound",
      "filters": {
        "protocols": [
          {
            "type": "icmp",
            "value": null
          }
        ]
      },
      "id": "3bf2ff59-fb69-4fbb-907c-92809b1a1433",
      "name": "allow-icmp",
      "priority": 65534,
      "status": "enabled",
      "targets": [
        {
          "type": "vpc",
          "value": "default"
        }
      ],
      "time_created": "2025-06-24T21:36:12.880024Z",
      "time_modified": "2025-06-24T21:36:12.880024Z",
      "vpc_id": "91a91cab-2fbd-4c1e-a91f-4f2bcae5705b"
    },
    {
      "action": "allow",
      "description": "allow inbound traffic to all instances within the VPC if originated within the VPC",
      "direction": "inbound",
      "filters": {
        "hosts": [
          {
            "type": "vpc",
            "value": "default"
          }
        ]
      },
      "id": "c17bc7d3-1fee-4cb6-a7a4-7bb7507d7e1e",
      "name": "allow-internal-inbound",
      "priority": 65534,
      "status": "enabled",
      "targets": [
        {
          "type": "vpc",
          "value": "default"
        }
      ],
      "time_created": "2025-06-24T21:36:12.880026Z",
      "time_modified": "2025-06-24T21:36:12.880026Z",
      "vpc_id": "91a91cab-2fbd-4c1e-a91f-4f2bcae5705b"
    },
    {
      "action": "allow",
      "description": "",
      "direction": "inbound",
      "filters": {
        "hosts": [],
        "ports": [
          "5200-5210"
        ],
        "protocols": []
      },
      "id": "e2bcad09-986d-4d8b-a3b1-e8fad2db0843",
      "name": "allow-iperf",
      "priority": 1000,
      "status": "enabled",
      "targets": [
        {
          "type": "vpc",
          "value": "default"
        }
      ],
      "time_created": "2025-06-24T21:36:12.880029Z",
      "time_modified": "2025-06-24T21:36:12.880029Z",
      "vpc_id": "91a91cab-2fbd-4c1e-a91f-4f2bcae5705b"
    },
    {
      "action": "allow",
      "description": "",
      "direction": "inbound",
      "filters": {
        "hosts": [],
        "ports": [
          "25"
        ],
        "protocols": [
          {
            "type": "tcp"
          }
        ]
      },
      "id": "ba2fc77c-c199-4d7c-b975-1e352a188476",
      "name": "allow-smtp",
      "priority": 1000,
      "status": "disabled",
      "targets": [
        {
          "type": "vpc",
          "value": "default"
        }
      ],
      "time_created": "2025-06-24T21:36:12.880027Z",
      "time_modified": "2025-06-24T21:36:12.880027Z",
      "vpc_id": "91a91cab-2fbd-4c1e-a91f-4f2bcae5705b"
    },
    {
      "action": "allow",
      "description": "allow inbound TCP connections on port 22 from anywhere",
      "direction": "inbound",
      "filters": {
        "ports": [
          "22"
        ],
        "protocols": [
          {
            "type": "tcp"
          }
        ]
      },
      "id": "ea212c9b-3b96-4090-9d1e-5f30a1b2e050",
      "name": "allow-ssh",
      "priority": 65534,
      "status": "enabled",
      "targets": [
        {
          "type": "vpc",
          "value": "default"
        }
      ],
      "time_created": "2025-06-24T21:36:12.880028Z",
      "time_modified": "2025-06-24T21:36:12.880028Z",
      "vpc_id": "91a91cab-2fbd-4c1e-a91f-4f2bcae5705b"
    }
  ]
}

[askfongjojo]

Sorry I should have used oxide api /v1/vpc-firewall-rules?project=angela&vpc=default to verify that first. I ran into the issue first in the console and saw it in the CLI too and thought that it's in the API itself. Let me move this ticket to the console repo.

[askfongjojo]

Ah nevermind, #2846 is already there.