bhouse-nexthop opened a new pull request, #14359:
URL: https://github.com/apache/cloudstack/pull/14359
### Description
`createNetworkACL` and `updateNetworkACLItem` accept protocol names that are
not valid, such as `cp`, `dp,ic` or `tcp,udp`. The rule is stored and listed
but never applied.
Fixes #14358
#### Why it breaks
`NetworkACLServiceImpl.validateProtocol()` checked a non-numeric protocol
with `supportedProtocolsForAclRules.contains(protocol.toLowerCase())`.
`supportedProtocolsForAclRules` is the string `"tcp,udp,icmp,all"`, so this is
a substring test: anything that appears inside it passes.
On the VR side, `SetNetworkAclConfigItem` doesn't recognise such a protocol,
tries `Integer.parseInt` on it, and drops the rule with only a warning in the
agent log. An allow or deny that the API accepted, and that the UI shows,
silently does nothing.
#### How it is fixed
The protocol is compared against the entries of the list (`split(",")`),
case-insensitively as before. The field, the error message and the valid names
are unchanged.
#### How to reproduce the old behaviour
1. `createNetworkACL aclid=<id> protocol=cp startport=22 endport=22
cidrlist=0.0.0.0/0 action=deny traffictype=ingress`
- Before: succeeds, and `listNetworkACLs` shows the rule with protocol
`cp`. No rule for it appears on the VR, and the agent logs "Problem occurred
when reading the entries in the ruleParts array".
- After: `Invalid protocol [cp]. Expected one of: [tcp,udp,icmp,all]`.
The old and new checks, side by side (jshell):
```
cp -> old check passes: true, new: false
t -> old check passes: true, new: false
dp,ic -> old check passes: true, new: false
, -> old check passes: true, new: false
tcp,udp -> old check passes: true, new: false
```
### Types of changes
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] New feature (non-breaking change which adds functionality)
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
- [ ] Build/CI
- [x] Test (unit or integration test code)
### Feature/Enhancement Scale or Bug Severity
#### Bug Severity
- [ ] BLOCKER
- [ ] Critical
- [ ] Major
- [x] Minor
- [ ] Trivial
### How Has This Been Tested?
- New
`NetworkACLServiceImplTest.validateProtocolTestProtocolIsPartOfTheSupportedList`
checks that `cp`, `t`, `dp,ic`, `,` and `tcp,udp` are each rejected.
- The existing tests for valid names (`tcp`, `udp`, `icmp`, `all`, any case)
and for protocol numbers still pass: `NetworkACLServiceImplTest`, 105 tests.
- `server` builds with checkstyle.
#### How did you try to break this feature and the system with this change?
- **Valid input:** every protocol name accepted today that is actually valid
is still accepted, in any case. Numeric protocols take the other branch and are
unaffected.
- **Existing rules:** a rule already stored with an invalid name would now
fail validation on its next update. Such a rule has never been applied, so the
error simply surfaces what was already broken.
- **Other open PRs:** this is independent of #14357, which also touches
`NetworkACLServiceImpl`, in a different method.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
