bhouse-nexthop opened a new issue, #14358: URL: https://github.com/apache/cloudstack/issues/14358
### problem `createNetworkACL` / `updateNetworkACLItem` accept protocol names that are not valid. `NetworkACLServiceImpl.validateProtocol()` checks a non-numeric protocol with: ```java supportedProtocolsForAclRules.contains(protocol.toLowerCase()) // "tcp,udp,icmp,all" ``` That is a substring test on the string `"tcp,udp,icmp,all"`, so `cp`, `t`, `dp,ic`, `,` and `tcp,udp` all pass. The rule is stored and listed, but is never applied. On the VR side, `SetNetworkAclConfigItem` doesn't recognise the protocol, tries `Integer.parseInt` on it, and drops the rule with only a warning in the agent log. An allow or a deny that the API accepted and the UI shows silently does nothing. ### versions Present on 4.22. ### The steps to reproduce the bug 1. `createNetworkACL aclid=<id> protocol=cp startport=22 endport=22 cidrlist=0.0.0.0/0 action=deny traffictype=ingress`. It succeeds. 2. `listNetworkACLs aclid=<id>` shows the rule with protocol `cp`. 3. Nothing for it appears in the VR's `ACL_INBOUND_ethX` chain. The agent logs "Problem occurred when reading the entries in the ruleParts array". ### What to do about it? Compare against the entries of the list, not against the string. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
