fermosan commented on issue #12668:
URL: https://github.com/apache/cloudstack/issues/12668#issuecomment-6048604210
I can reproduce this on a VPC virtual router (CloudStack 4.23.0.0, VR
template <4.22.0>, KVM, iptables v1.8.9 (nf_tables)).
Why a single multi-CIDR rule looks fine: it only goes wrong when the
multi-CIDR rule is followed by other rules in the same ACL list. With just one
rule there is nothing after it, so the order cannot be seen to be wrong.
Setup: a tier ACL list with ingress rules such as 10 (allow tcp 80,
10.10.0.0/24,10.10.7.0/24), 12 (allow tcp 135, three CIDRs), 13 (allow tcp 443,
0.0.0.0/0), more single- and multi-CIDR rules, and a deny at 9998.
Result on the VR (iptables -L ACL_INBOUND_eth9 -n -v --line-numbers, and
the same for ACL_OUTBOUND_* in the mangle table):
3 ACCEPT tcp 10.10.7.0/24 tcp dpt:80 <- only the LAST cidr of rule 10
5 ACCEPT tcp 10.10.4.0/24 tcp dpt:135 <- only the LAST cidr of rule 12
6 ACCEPT tcp 0.0.0.0/0 tcp dpt:443
21 DROP <- explicit deny (rule 9998)
29 ACCEPT tcp 10.10.2.0/24 tcp dpt:135 <- other CIDRs of rule 12,
behind the DROP
30 ACCEPT tcp 10.10.0.10 tcp dpt:135
31 ACCEPT tcp 10.10.0.0/24 tcp dpt:80 <- other CIDR of rule 10,
behind the DROP
32 DROP <- the VR's own final DROP
In every multi-CIDR rule only the last CIDR lands in the right place. The
rest are appended after the explicit deny, so they never match. It happens in
both ingress (filter) and egress (mangle). Single-CIDR rules are fine.
Impact: allow rules silently stop working for all but one CIDR. A deny
with several CIDRs (for example "block private ranges" placed before an
internet allow) would end up after the allow and stop denying.
Possible cause (from reading configure.py, not tested):
AclDevice.process() raises the insert index by 1 per ACL rule, and
AclRule.create() emits one -A <chain> -s a,b,c ....
iptables expands the comma-separated source into several rules, so the
tracked index drifts after every multi-CIDR rule, and CsNetfilter inserts
"right before the DROP all" at the wrong position.
Workaround: one CIDR per rule, as @bradh352 wrote.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
