bhouse-nexthop opened a new issue, #14363:
URL: https://github.com/apache/cloudstack/issues/14363
### problem
On a VPC virtual router, a network ACL rule for `tcp` or `udp` with no port
range matches only port 0. It should match every port. Nothing is reported.
- **How the rule reaches the VR:** a rule without ports is sent as the range
`0:0` (`NetworkACLTO.getStringPortRange()`). `SetNetworkAclConfigItem` builds a
`TcpAclRule`/`UdpAclRule`, whose ports are `int`s, so the VR always receives
`"first_port": 0, "last_port": 0`.
- **On the VR:** `configure.py`'s `AclRule.init_vpc()` only checks that
`first_port` is present, so it renders:
```
-A ACL_INBOUND_eth3 -p tcp -s 10.0.0.0/8 -m tcp --dport 0 -j ACCEPT
```
What that does:
- **An allow** ("tcp from 10.0.0.0/8, no ports") admits nothing.
- **A deny** blocks nothing, so the traffic goes on to the rules after it.
With a broader allow later in the list, the deny is silently bypassed.
This is the iptables path: IPv4 on VPC tiers and private gateways that are
not in routed mode. The nftables paths (routed IPv4 and IPv6) treat `0` as "no
ports" and match all of them. So the same rule allows all TCP on IPv6 and none
on IPv4.
### versions
Present on 4.22.
### The steps to reproduce the bug
1. In a VPC ACL list, add an ingress rule: protocol TCP, no start/end port,
CIDR `10.0.0.0/8`, Allow. Attach the list to a tier.
2. On the VR, run `iptables -S ACL_INBOUND_ethX`. The rule shows as `-s
10.0.0.0/8 -p tcp -m tcp --dport 0 -j ACCEPT`.
### What to do about it?
On the iptables path, treat `0:0` as no ports, as the nftables paths do.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
