bhouse-nexthop commented on code in PR #14364:
URL: https://github.com/apache/cloudstack/pull/14364#discussion_r4273556951
##########
systemvm/debian/opt/cloud/bin/configure.py:
##########
@@ -632,7 +632,9 @@ def init_vpc(self, direction, acl, rule, config):
self.dport = ""
if 'allowed' in list(rule.keys()) and rule['allowed']:
self.action = "ACCEPT"
- if 'first_port' in list(rule.keys()):
+ # A tcp or udp rule without ports is sent with the range 0:0;
like the nft paths, match all ports
+ no_ports = rule.get('first_port', 0) == 0 and
rule.get('last_port', 0) == 0
Review Comment:
Yes, done in 20e1dc4b17. The VR can't tell port 0 alone from no ports:
`getPublicEndPort()` falls back to the start port, and
`NetworkACLTO.getStringPortRange()` sends `0:0` either way. So
`validateSourceStartAndEndPorts` now refuses `0:0` and says to omit the ports
to match all ports. That check covers create, update and import. A range
starting at 0, such as `0:1024`, is still accepted. Added unit tests for both
cases.
Rules already stored as `0:0` stay as they are and will match all ports once
the router has the new scripts; the SQL in the upgrade note finds them.
Updating one of those rules now requires clearing its ports or setting a real
range.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
