github-actions[bot] commented on issue #14669: URL: https://github.com/apache/cloudstack/issues/14669#issuecomment-6802610651
> [!WARNING] > threat detection engine error > The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding. > > <!-- gh-aw-threat-engine-error --> > > <details> > <summary>What happened</summary> > > The threat detection engine failed to produce results. > > Review the [workflow run logs](https://github.com/apache/cloudstack/actions/runs/43029422543) for details. > > </details> ## ๐ฏ Triage report On a VPC with the Firewall service, a firewall rule created on a new public IP before any PF or LB rule prevents the IP from being configured on the VR. `applyRules` skips the IP association for VPC firewall rules, so no `IpAssocVpcCommand` is sent later when the PF or LB rule is applied. The VR also deletes the firewall rules from `FIREWALL_<ip>` at that point. Creating the PF or LB rule first avoids the problem. The reporter's table shows the difference on 4.23.0.0. ### ๐ Assessment | Dimension | Value | Reasoning | | --- | --- | --- | | **Type** | type:bug | IP not configured on the VR and rules dropped, depending on rule order | | **Component** | component:vpc, component:virtual-router | Association in `IpAddressManagerImpl`, rule handling on the VR | | **Severity** | Severity:Major | Public IP unreachable with a valid firewall rule until a workaround is applied | | **Labels** | type:bug, component:vpc, component:virtual-router, Severity:Major | | | **Coding agent** | Needs more info | Association logic for VPC IPs and VR chain cleanup both need maintainer review | ### ๐ Similar issues - #14668 (related) โ CKS on a VPC tier fails when the VPC has the Firewall service; the reporter found this while fixing it - #14068 (related) โ NPE when destroying a VPC tier with the Firewall service (fixed in PR #14133) - #14147 (related) โ UI firewall rule lost when a PF rule is created on a conserve-mode VPC network <details> <summary>๐ก Notes and suggestions</summary> - Reproduction: in a VPC with the Firewall service, associate a new IP, add a firewall rule on it, then add a port forward on it. Check `ip addr` on the VR and `/var/log/cloud.log`. - The released-IP case (leftover `FIREWALL_<ip>` chain and PREROUTING jump) is a separate cleanup item; consider a separate issue. </details> > Generated by [Daily Issue Triage](https://github.com/apache/cloudstack/actions/runs/43029422543) ยท copilot ยท haiku55 ยท \~6 AIC ยท โ 3.8K ยท [โท](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues) <details> <summary><sub>Add this agentic workflow to your repo</sub></summary> To install this agentic workflow, run ``` gh aw add githubnext/agentics/workflows/daily-issue-triage.md@139fa09ef17cde4135e696ff8e7af09bc5ddfa6e ``` </details> <!-- gh-aw-workflow-call-id: apache/cloudstack/daily-issue-triage --> <!-- gh-aw-agentic-workflow: Daily Issue Triage, engine: copilot, model: claude-haiku-5.5, id: 43029422543, workflow_id: daily-issue-triage, run: https://github.com/apache/cloudstack/actions/runs/43029422543 --> <!-- gh-aw-execution: {"version":1,"repo_id":"9759448","repository":"apache/cloudstack","aw_workflow_id":"daily-issue-triage","run_id":"43029422543","run_attempt":"1","run_url":"https://github.com/apache/cloudstack/actions/runs/43029422543","publishing_job":{"key":"safe_outputs","check_run_id":"130687254582"}} --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
