github-actions[bot] commented on issue #13521:
URL: https://github.com/apache/cloudstack/issues/13521#issuecomment-5356776549

   ## ๐ŸŽฏ Triage report
   
   Private-VLAN (PVLAN) isolation on shared networks with KVM/OVS is broken: 
VMs cannot reach their default gateway due to OVS flow table 1 stripping the 
VLAN tag and then failing to match on the untagged packet. A 
maintainer-proposed script fix (`ovs-pvlan-kvm-vm.sh`) resolved the 
gateway-ping issue but introduced a regression where VM-to-VM isolation (the 
entire point of PVLANs) is also broken โ€” VMs can now ping each other across the 
isolated VLAN.
   
   ### ๐Ÿ“Š Assessment
   
   | Dimension | Value | Reasoning |
   |---|---|---|
   | **Type** | type:bug | OVS flow rules for PVLAN incorrectly match/rewrite 
traffic, breaking both connectivity and isolation |
   | **Component** | component:networking, component:kvm | Bug is in the OVS 
PVLAN scripts used by the KVM hypervisor plugin |
   | **Severity** | Severity:Major | Breaks a security-relevant isolation 
feature (private VLANs) โ€” traffic that should be isolated is not, which is a 
functional/security regression, not just a connectivity nuisance |
   | **Labels** | type:bug, component:networking, component:kvm, Severity:Major 
| See above |
   | **Coding agent** | Needs more info | The flow-rule change needed is 
partially known (`ovs-pvlan-kvm-vm.sh` table=1 matching), but a full fix 
requires re-deriving correct OVS flow semantics for PVLAN isolation between 
community/isolated ports without breaking gateway reachability โ€” needs a 
maintainer/contributor with OVS expertise and a test environment |
   
   ### ๐Ÿ”— Similar issues
   
   No closely related open duplicates found.
   
   <details><summary>๐Ÿ’ก Notes and suggestions</summary>
   
   The maintainer's suggested change (`vlan_tci=0x0000` match instead of 
re-adding the VLAN tag) fixed gateway connectivity but removed the isolation 
between VM ports, which defeats the purpose of PVLANs. The real fix likely 
needs a table=1 rule that matches on the stripped/untagged packet **and** still 
enforces the isolated/community/promiscuous port relationships (i.e., 
re-inserting the appropriate community/isolated group actions instead of a 
blanket `output:<port>`). The reporter has a live test environment and offered 
to test further changes โ€” a maintainer with OVS/PVLAN knowledge should propose 
a refined flow rule.
   
   </details>
   
   
   
   > Generated by [Daily Issue 
Triage](https://github.com/apache/cloudstack/actions/runs/32375697891) ยท 
sonnet50 224.8K ยท 
[โ—ท](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues)
   >
   <details>
   <summary>Add this agentic workflows to your repo</summary>
   
   To install this agentic workflow, run
   
   ```
   gh aw add 
githubnext/agentics/workflows/daily-issue-triage.md@d7c1dc4b72b00607a67caaffdcc216cb64379cf9
   ```
   </details>
   
   
   <!-- gh-aw-agentic-workflow: Daily Issue Triage, engine: copilot, version: 
1.0.52, model: claude-sonnet-5, id: 32375697891, workflow_id: 
daily-issue-triage, run: 
https://github.com/apache/cloudstack/actions/runs/32375697891 -->
   <!-- gh-aw-workflow-call-id: apache/cloudstack/daily-issue-triage -->


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to