bhouse-nexthop opened a new issue, #14627:
URL: https://github.com/apache/cloudstack/issues/14627
### problem
The built-in `default_allow` network ACL list ("Default Network ACL Allow
All") allows all IPv4 traffic but no IPv6 traffic. A dual-stack VPC tier that
uses it gets no IPv6 ingress and no IPv6 egress through the VPC router.
Why:
- The list is seeded in `schema-410to420.sql` with two items, `all` Ingress
Allow and `all` Egress Allow, each with the single CIDR `0.0.0.0/0`. No later
upgrade adds `::/0` to them.
- On the VPC router, `CsAcl.__process_ip6()` in `configure.py` removes the
IPv4 CIDRs from each rule (`removeUndesiredCidrs(cidr, 4)`) and skips a rule
that has none left. Both `default_allow` items are skipped. The tier's `ip6
ip6_acl` chains (`<dev>_ingress_policy` and `<dev>_egress_policy`) are left
with only their closing `drop` rule.
- The IPv4 side renders as expected: `-j ACCEPT` for all protocols in both
directions.
`default_deny` is not affected in practice: its items also carry only
`0.0.0.0/0` and are skipped on IPv6, and the chain still ends in `drop`.
This looks inconsistent with the rest of the ACL code, which treats "all
addresses" as both families:
- `createNetworkACL` without `cidrlist` creates the rule with `0.0.0.0/0`
and `::/0` (since IPv6 VPC tiers were added in 4.17).
- `SetNetworkACLCommand` sends `0.0.0.0/0,::/0` to the router for a rule
that has no CIDR.
I'm not sure if this is meant to be this way. Opening up IPv6 on
`default_allow` would change existing deployments on upgrade. A dual-stack
tier's IPv6 addresses are reachable from outside without NAT, so every VM on a
`default_allow` tier would become reachable over IPv6 on all ports. Whether
that is what "Allow All" should mean for IPv6, or whether IPv6 should stay
closed and the behaviour be documented, needs a decision from the community.
### versions
4.17 and later (since IPv6 support for VPC tiers). Seen on 4.22 and main,
with system VM template 4.22.0.
### The steps to reproduce the bug
1. Create a zone IPv6 guest prefix and a dual-stack VPC offering and
dual-stack VPC tier network offering.
2. Create a VPC and a tier on it with `aclid` set to `default_allow`. Deploy
a VM on the tier.
3. On the VPC router: `nft list table ip6 ip6_acl`. The tier's ingress and
egress policy chains contain only the final drop rule. `iptables -S` shows the
`default_allow` rules as `ACCEPT` for IPv4.
4. From the VM, an IPv6 connection to an external address fails. An IPv6
connection to the VM from outside the VPC also fails. The same over IPv4 (with
a static NAT or port forwarding for ingress) works.
### What to do about it?
Two options, and I don't know which one is intended:
1. Make `default_allow` allow IPv6 too. This needs an upgrade SQL that adds
`::/0` to the two `default_allow` items (seed data, so `main` only). It opens
IPv6 on every existing tier on that list at the next ACL apply, so it would
need a release note.
2. Keep IPv6 closed on `default_allow`, and document that a dual-stack tier
needs its own ACL list with `::/0` rules. The list's description could say
"IPv4" so it isn't mistaken for both families.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
