bhouse-nexthop opened a new issue, #14351:
URL: https://github.com/apache/cloudstack/issues/14351
### problem
On a network in **routed** mode (IPv4 routing, introduced in 4.20 with
#9470), a network ACL rule that uses a protocol number (e.g. `47` for GRE) is
never applied on the VR.
`CsAcl.AclDevice.__process_routing_ip4()` in
`systemvm/debian/opt/cloud/bin/configure.py` renders it as:
```
ip saddr 1.2.3.4/32 ip nexthdr 47 accept
```
`nexthdr` is an IPv6 header field. The IPv4 equivalent is `ip protocol`, so
nft rejects the rule:
```
$ nft add rule ip ip4_acl eth3_ingress_policy ip saddr 1.2.3.4/32 ip nexthdr
47 accept
Error: syntax error, unexpected string
add rule ip ip4_acl eth3_ingress_policy ip saddr 1.2.3.4/32 ip nexthdr 47
accept
^^^^^^^
```
The rules are added one `nft add rule` at a time and the failure is only
logged in `/var/log/cloud.log`, so the rule is silently missing from `ip4_acl`
while the rest of the ACL loads. An allow rule for that protocol therefore
never matches. A deny rule for it is also lost, so that traffic falls through
to whatever later rule matches it.
The IPv6 path (`__process_ip6`, `ip6 nexthdr`) is correct. Non-routed VPCs
use iptables and are not affected.
### versions
CloudStack 4.20 onward (still present on 4.22).
### The steps to reproduce the bug
1. Create a VPC (or network) in routed mode with an IPv4 tier.
2. Add an ACL rule to the tier's ACL list: protocol number `47`, CIDR
`0.0.0.0/0`, action Allow.
3. On the VR, run `nft list table ip ip4_acl`. The rule is missing from
`ethX_ingress_policy`.
4. `grep "ip nexthdr" /var/log/cloud.log` shows the failed `nft add rule`.
### What to do about it?
Render the IPv4 match as `ip protocol <n>`, which nft accepts (it lists it
as `ip protocol gre`).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
