bhouse-nexthop commented on PR #14364:
URL: https://github.com/apache/cloudstack/pull/14364#issuecomment-6727079859
### Test report: tcp/udp ACL rules without ports, on a running VPC router
@Damans227 asked for the rules a VPC router shows for a tcp rule with no
ports and for a `0:0` rule. They are below, together with traffic results and a
run of the stock `configure.py` on the same router for comparison.
**Environment**
- A CloudStack 24.0 (main) build with this PR applied, alongside some of my
other open PRs.
- Why the result carries over to 4.22:
- Main still ships system VM template 4.22.0, and this part of
`configure.py` is the same on 4.22 and main.
- Main adds the VPC public-IP firewall, which puts `purpose=Firewall`
items in the same ACL data. So I used a VPC offering *without* the Firewall
service, as on 4.22.
- Three KVM hosts on Ubuntu 24.04, nested virtualisation; Ceph RBD primary
storage.
- System VM template 4.22.0 (Debian 12, iptables 1.8.9 (nf_tables), nft
1.0.6, Python 3.11). The router was created on this build, and its
`/opt/cloud/bin/configure.py` matches the build's.
- A dual-stack VPC with two tiers:
- T1, which holds the server V1 (Ubuntu 24.04), with the test ACL list;
- T2, which holds the client V2, with `default_allow`.
- An external host on the public network for the IPv6 checks.
**Steps and evidence**
1. **Create the rules on T1's list:**
- `number=10 protocol=tcp cidrlist=<T2> action=allow` (no ports);
- egress `number=11 protocol=udp cidrlist=0.0.0.0/0 action=allow` (no
ports);
- `number=12 protocol=tcp startport=0 endport=1024 cidrlist=<T2>
action=allow`.
The router shows:
```
-A ACL_INBOUND_eth2 -s 172.16.2.0/24 -p tcp -j ACCEPT
-A ACL_INBOUND_eth2 -s 172.16.2.0/24 -p tcp -m tcp --dport 0:1024 -j
ACCEPT
-A ACL_INBOUND_eth2 -j DROP
(mangle) -A ACL_OUTBOUND_eth2 -p udp -j ACCEPT
```
From V2, `nc -z` to V1 on tcp 8080, 5000 and 22 all connect, and `curl
http://V1:8080/` returns 200.
2. **Deny without ports.** I replaced rule 10 with `number=5 protocol=tcp
action=deny` (no ports), followed by `number=20 protocol=all action=allow`.
```
-A ACL_INBOUND_eth2 -s 172.16.2.0/24 -p tcp -j DROP
-A ACL_INBOUND_eth2 -s 172.16.2.0/24 -p tcp -m tcp --dport 0:1024 -j
ACCEPT
-A ACL_INBOUND_eth2 -j ACCEPT
```
tcp 8080, 5000 and 22 from V2 now time out, while ICMP from V2 still
passes (rule 20).
3. **Port 0 alone is refused.** On create, `startport=0 endport=0` (tcp and
udp) and `startport=0` alone all fail with:
```
(HTTP 431, error code 4350) Port 0 alone is not a valid port range; omit
start port and end port to match all ports
```
`updateNetworkACLItem` setting rule 12 to `startport=0 endport=0` fails
with the same message (job result 431), and the rule keeps `0:1024`.
4. **A `0:0` rule already stored (the upgrade case).**
- I removed rules 5 and 20, so that rule 12 alone decides. tcp 8080 from
V2 then times out, because 8080 is outside 0:1024.
- I set rule 12 to `start_port=0, end_port=0` in `network_acl_item` and
ran `restartVPC cleanup=false livepatch=true`.
- The router shows:
```
-A ACL_INBOUND_eth2 -s 172.16.2.0/24 -p tcp -j ACCEPT
```
- tcp 22, 8080 and 5000 from V2 all connect.
5. **IPv6.** The rule `number=13 protocol=tcp cidrlist=<external /64>
action=allow` (no ports) renders in `ip6 ip6_acl`:
```
ip6 saddr fd00:30::/64 tcp dport 0-65535 accept
```
tcp 22 from the external host connects. A closed port gets a reset rather
than a timeout, so the rule matches every port. The nft path already treated 0
as "all ports" before this PR, and the stock script renders this line the same
way. The PR doesn't change it.
6. **Stock `configure.py` (apache/main) on the same router**, with the list
re-applied:
```
-A ACL_INBOUND_eth2 -s 172.16.2.0/24 -p tcp -m tcp --dport 0 -j ACCEPT
(mangle) -A ACL_OUTBOUND_eth2 -p udp -m udp --dport 0 -j ACCEPT
```
tcp 22 and 8080 from V2 time out. `restartVPC livepatch=true` put the
PR's script back, the rule went back to `-p tcp -j ACCEPT`, and 8080 connected
again.
**Result:** pass.
- tcp and udp rules without ports render without `--dport` and match every
port, for both allow and deny.
- `0:1024` is kept as given.
- Port 0 alone is refused on create and on update.
- A stored `0:0` rule renders as all ports after a livepatch.
- The stock script renders `--dport 0` and blocks the traffic.
**Not covered**
- A router running an older template (only 4.22.0 was used).
- Routed-mode (nft IPv4) rules without ports. That path already treated 0 as
no ports and isn't changed.
- Redundant VPC routers.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
