github-actions[bot] commented on issue #14445: URL: https://github.com/apache/cloudstack/issues/14445#issuecomment-6304126253
## ๐ฏ Triage report Well-documented bug: redundant VRs in ROUTED-mode isolated networks/VPCs both come up PRIMARY because the nftables `INPUT` whitelist built by `CsAddress.py` (`fw_router_routing` / `fw_vpcrouter_routing`) is missing ACCEPT rules for VRRP (224.0.0.18, IP proto 51 with keepalived `auth_type AH`) and conntrackd sync (225.0.0.50), which are present in the non-ROUTED iptables path. The reporter has root-caused this precisely, included clear repro steps/output, and states a fix (two added ACCEPT rules) already works in their testing with a linked PR. ### ๐ Assessment | Dimension | Value | Reasoning | |---|---|---| | **Type** | type:bug | Clear functional defect with reproducible incorrect behavior (dual PRIMARY VRs) | | **Component** | component:networking, component:virtual-router, component:kvm | Affects VR nftables rules (systemvm scripts) for ROUTED network/VPC mode on KVM | | **Severity** | Severity:Major | Breaks redundant router HA failover for ROUTED networks/VPCs (duplicate gateway/public IP), but workaround/fix is known and scope is limited to ROUTED mode | | **Labels** | type:bug, component:networking, component:virtual-router, component:kvm, Severity:Major | See above | | **Coding agent** | Suitable | Root cause and fix are already identified by the reporter (two missing nftables ACCEPT rules in `CsAddress.py`), with a linked PR reportedly validated in testing โ well-scoped, self-contained change | ### ๐ Similar issues - apache/cloudstack#11565 (related) โ requests redundant VR support in ROUTED networks; this issue identifies the remaining gap (missing VRRP/conntrackd ACCEPT rules) left after that feature's initial implementation (#9470). <details><summary>๐ก Notes and suggestions</summary> - Confirm whether the reporter's linked PR (mentioned in the issue body but not included in this report) has been opened against `apache/cloudstack`; if so, cross-link it here and route review to someone familiar with `CsAddress.py` / systemvm nftables scripts. - Validate the fix covers both `ip4_firewall` (isolated networks) and `ip4_acl` (VPC) tables for both Static and Dynamic routing modes, as noted by the reporter. - Also worth confirming the reporter's side note: the UI's redundant-router switch is only shown when SourceNat is selected, so it never appears for ROUTED offerings โ this may need a separate UI/UX follow-up (component:UI) since users currently need the API to create a redundant ROUTED offering at all. - Suggested verification steps (from the issue): after applying the fix, confirm `nft list chain ip ip4_firewall INPUT` (or `ip4_acl` for VPCs) includes ACCEPT rules for 224.0.0.18/32 and 225.0.0.50/32, and that `tcpdump -ni eth0 host 224.0.0.18` shows one VR entering/staying BACKUP. </details> > Generated by [Daily Issue Triage](https://github.com/apache/cloudstack/actions/runs/39431466476) ยท sonnet50 86.7K ยท [โท](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues) > <details> <summary>Add this agentic workflows to your repo</summary> To install this agentic workflow, run ``` gh aw add githubnext/agentics/workflows/daily-issue-triage.md@d7c1dc4b72b00607a67caaffdcc216cb64379cf9 ``` </details> <!-- gh-aw-agentic-workflow: Daily Issue Triage, engine: copilot, version: 1.0.52, model: claude-sonnet-5, id: 39431466476, workflow_id: daily-issue-triage, run: https://github.com/apache/cloudstack/actions/runs/39431466476 --> <!-- gh-aw-workflow-call-id: apache/cloudstack/daily-issue-triage --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
