fermosan commented on issue #12668:
URL: https://github.com/apache/cloudstack/issues/12668#issuecomment-6048768831
Follow-up: the IPv6 side of the same problem is worse, those rules are not
misplaced, they are not applied at all.
On the same router (4.23.0.0, VR template 4.22.0), the ACL list has 20 IPv6
ingress rules. `nft list chain ip6 ip6_acl eth9_ingress_policy` contains 15 of
them. The 5 that are missing are exactly the rules whose cidrlist has **two or
more IPv6 CIDRs** (tcp 4172, tcp 4521, tcp 6283-6284, tcp 52000-60000 and an
ICMPv6 rule). Rules with exactly one IPv6 CIDR, including mixed IPv4+IPv6
rules, are applied correctly. Nothing is reported in the UI or API.
Cause: `AclDevice.__process_ip6` in `configure.py` builds the rule from the
whole comma-separated string (`addr = "ip6 saddr " + cidr`), and nft does not
accept a bare comma list. Checked on the VR with `nft -c` (nothing applied):
```
$ nft -c add rule ip6 ip6_acl eth9_ingress_policy ip6 saddr
2001:db8:a1:2009::/64,2001:db8:a1:afd2::/64 tcp dport 4172 accept
Error: syntax error, unexpected /, expecting end of file or newline or
semicolon
$ nft -c add rule ip6 ip6_acl eth9_ingress_policy ip6 saddr '{
2001:db8:a1:2009::/64, 2001:db8:a1:afd2::/64 }' tcp dport 4172 accept
(no error)
```
`cloud.log` shows each IPv6 ACL rule being added one at a time with `nft add
rule ip6 ip6_acl ...`, so only the failing rules disappear and the rest of the
list loads.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
