bhouse-nexthop opened a new issue, #14356: URL: https://github.com/apache/cloudstack/issues/14356
### problem A VPC network ACL rule can lose its port range or ICMP type on the virtual router. The rule is then applied to the whole protocol: an allow opens more than intended, and a deny blocks more. Nothing is reported. The VR applies ports only to a rule it receives as `tcp` or `udp`, and an ICMP type/code only to one it receives as `icmp`. `SetNetworkACLCommand.generateFwRules()` passes the protocol through as stored. `SetNetworkAclConfigItem` then turns anything else into a bare protocol-number rule (`ProtocolAclRule`), which has no port or ICMP fields. That happens to: 1. **Protocol number 6 or 17 with ports.** The UI offers Start/End port for "Protocol number", and the API accepts them. A rule "protocol 6, port 22, allow" is applied on the VR as `-p 6 -j ACCEPT`, which allows **all TCP**. 2. **Protocol number 1 set by `updateNetworkACLItem`.** `createNetworkACL` turns protocol `1` into `icmp`, but `updateNetworkACLItem` does not. Updating a rule to protocol 1 with an ICMP type stores `1`, clears the type, and the VR allows all ICMP. 3. **Upper-case protocol names** (`ICMP`, `TCP`), which the API accepts and stores as given. `generateFwRules()` compares `"icmp"` case-sensitively, so for `ICMP` it sends the (empty, `0:0`) port range where the ICMP type and code belong. The VR then applies ICMP type 0 code 0, which is echo-reply only, whatever type was asked for. 4. **Any other protocol number with ports** (e.g. 132 SCTP). The UI and API accept the ports, and the VR ignores them. ### versions Present on 4.22; the code involved is older. ### The steps to reproduce the bug 1. In a VPC ACL list, add an ingress rule: Protocol number `6`, start/end port `22`, CIDR `0.0.0.0/0`, Allow. Attach the list to a tier. 2. On the VR, run `iptables -S ACL_INBOUND_ethX`. The rule shows as `-A ACL_INBOUND_ethX -s 0.0.0.0/0 -p tcp -j ACCEPT`, with no `--dport`, so every TCP port is open from anywhere. 3. Likewise, `createNetworkACL protocol=ICMP icmptype=8 icmpcode=0 ...` shows as `-p icmp -m icmp --icmp-type 0/0`. ### What to do about it? - In `generateFwRules()`, send 1, 6 and 17, and any case, to the VR as `icmp`, `tcp` and `udp`, so their ports and ICMP type are kept. - Have `updateNetworkACLItem` treat protocol 1 as ICMP, as create does. - Reject ports with any other protocol number, and stop the UI offering them. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
