github-actions[bot] commented on issue #14591: URL: https://github.com/apache/cloudstack/issues/14591#issuecomment-6686139523
> [!WARNING] > threat detection engine error > The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding. > > <!-- gh-aw-threat-engine-error --> > > <details> > <summary>What happened</summary> > > The threat detection engine failed to produce results. > > Review the [workflow run logs](https://github.com/apache/cloudstack/actions/runs/42225768461) for details. > > </details> ## 🎯 Triage report On isolated and VPC networks, the virtual router counts only IPv4 traffic for network usage, because its counters use iptables while IPv6 goes through nftables. A dual-stack network therefore under-reports usage. Shared networks already count IPv6 via libvirt NIC stats. The reporter proposes that routers count IPv6 too, so usage is consistent. This is linked to #14578 and to the IPv6 exemption config added in #14583. ### 📊 Assessment | Dimension | Value | Reasoning | | --- | --- | --- | | **Type** | type:enhancement | Feature gap in usage accounting; no crash or regression reported | | **Component** | component:virtual-router, component:usage-server | Counters live on the VR; records feed the usage server | | **Severity** | n/a | Not a bug report | | **Labels** | type:enhancement, component:virtual-router, component:usage-server | Based only on the issue text | | **Coding agent** | Needs more info | Direction is clear, but the nftables counter design and how it interacts with #14583 need maintainer input | ### 🔗 Similar issues - #14578 (related) — allow excluding destinations from network usage; the reporter says this issue came out of that work - #14445 (related) — redundant VRs with nftables rules on ROUTED networks/VPCs; same nftables area on the VR <details> <summary>💡 Notes and suggestions</summary> - The issue names #14583 as the source of the `network.usage.exempt.cidrs` IPv6 entries. Maintainers may want to confirm whether routers should count IPv6 before the exemption list is used for VR networks. - Check how the VR counters are read today (iptables vs nft) before choosing an approach. The issue does not address this. </details> > Generated by [Daily Issue Triage](https://github.com/apache/cloudstack/actions/runs/42225768461) · copilot · haiku55 · \~3 AIC · ⊞ 3.8K · [◷](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues) <details> <summary><sub>Add this agentic workflow to your repo</sub></summary> To install this agentic workflow, run ``` gh aw add githubnext/agentics/workflows/daily-issue-triage.md@139fa09ef17cde4135e696ff8e7af09bc5ddfa6e ``` </details> <!-- gh-aw-workflow-call-id: apache/cloudstack/daily-issue-triage --> <!-- gh-aw-agentic-workflow: Daily Issue Triage, engine: copilot, model: claude-haiku-5.5, id: 42225768461, workflow_id: daily-issue-triage, run: https://github.com/apache/cloudstack/actions/runs/42225768461 --> <!-- gh-aw-execution: {"version":1,"repo_id":"9759448","repository":"apache/cloudstack","aw_workflow_id":"daily-issue-triage","run_id":"42225768461","run_attempt":"1","run_url":"https://github.com/apache/cloudstack/actions/runs/42225768461","publishing_job":{"key":"safe_outputs","check_run_id":"127921318265"}} --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
