bhouse-nexthop opened a new pull request, #14643:
URL: https://github.com/apache/cloudstack/pull/14643
### Description
This PR fixes two problems with `updateNetworkACLItem` when
`partialupgrade=false`, which replaces every field of the rule.
1. **Missing fields broke the rule.** Without `cidrlist` or `traffictype`,
the rule was written with those fields null, and then the call failed with an
NPE on the null CIDR list. The row had already been committed, so
`listNetworkACLs` and the next ACL apply failed on the null traffic type until
the rule was fully updated again. Without `protocol`, the call failed with an
NPE.
- A full update without `protocol`, `cidrlist` or `traffictype` is now
refused before anything is changed: "The protocol, cidrlist and traffictype
must be given when the ACL rule is updated with partialupgrade=false".
- I chose refusing over defaulting them as `createNetworkACL` does
(`0.0.0.0/0,::/0` and Ingress). A default would silently open a rule to every
address or turn an egress rule into an ingress rule.
- `NetworkACLItemDaoImpl.update()` now writes the rule and its CIDRs in
one transaction, as `persist()` already does. A failure on the CIDRs now rolls
back the rule as well.
- `action` is unchanged: when it is left out it is still Allow, as before
and as on create.
2. **An ICMP type or code given with another protocol was dropped.**
`partialupgrade=false protocol=tcp icmptype=8` was accepted and stored as tcp.
The values are now kept, so the existing check refuses them with "Can specify
icmpCode and icmpType for ICMP protocol only", as `createNetworkACL` and a
partial update already do. When none is given, changing an ICMP rule to another
protocol still clears the ICMP type and code.
Behaviour changes to note:
- An invalid `traffictype` (for example `egres`) is now refused with
"Invalid traffic type egres", as on create. Before, a partial update silently
ignored it.
- The `traffictype` and `partialupgrade` parameter descriptions are updated
to match.
The UI's edit dialog always sends `protocol`, `cidrlist` and `traffictype`
with `partialupgrade=false`, so it is not affected.
Relation to other open PRs:
- #14046 removes the NPE for a missing protocol. With this PR, a full update
without a protocol doesn't reach that code any more. The two PRs don't touch
the same lines.
- #14357 maps protocol number 1 to `icmp` in the same command. It is
independent of this PR.
Fixes: #14642
### Types of changes
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] New feature (non-breaking change which adds functionality)
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
- [ ] Build/CI
- [ ] Test (unit or integration test code)
### Feature/Enhancement Scale or Bug Severity
#### Bug Severity
- [ ] BLOCKER
- [ ] Critical
- [ ] Major
- [x] Minor
- [ ] Trivial
### How Has This Been Tested?
- Found while testing VPC ACL changes on a 3-host KVM lab running 24.0
(main). The steps in #14642 reproduce both problems there.
- Unit tests in `NetworkACLServiceImplTest`:
- a full update without protocol, without cidrlist, or without traffictype
is refused, and nothing is set on the rule;
- a full update with only the required values sets them and clears the
rest;
- tcp with `icmptype=8` is refused by `validateNetworkACLItem`;
- changing an ICMP rule to tcp clears the ICMP fields;
- `traffictype` parsing: blank, valid in either case, and invalid.
- `mvn -pl server -am test
-Dtest=NetworkACLServiceImplTest,NetworkACLManagerTest`: 109 and 8 tests, all
pass.
#### How did you try to break this feature and the system with this change?
- Checked the UI's edit call (`AclRulesTab.vue`). It sends every field, and
an empty `cidrlist` is still accepted as an empty list, as before.
- Checked the other callers of `NetworkACLItemDaoImpl.update()` (rule state
changes and revoke). They pass rules loaded with their CIDRs, and the nested
transaction commits with the outer one.
- Partial updates (the default) behave as before, apart from refusing an
invalid `traffictype`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
