[
https://issues.apache.org/jira/browse/CLOUDSTACK-10043?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16262450#comment-16262450
]
ASF GitHub Bot commented on CLOUDSTACK-10043:
---------------------------------------------
resmo closed pull request #2323: CLOUDSTACK-10043: fix restore default drop for
egress rules in ACL
URL: https://github.com/apache/cloudstack/pull/2323
This is a PR merged from a forked repository.
As GitHub hides the original diff on merge, it is displayed below for
the sake of provenance:
As this is a foreign pull request (from a fork), the diff is supplied
below (as it won't show otherwise due to GitHub magic):
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsAddress.py
b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsAddress.py
index 071a7b2ec48..555440c7771 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsAddress.py
+++ b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsAddress.py
@@ -455,6 +455,9 @@ def fw_vpcrouter(self):
["mangle", "front", "-A ACL_OUTBOUND_%s -d 225.0.0.50/32 -j
ACCEPT" % self.dev])
self.fw.append(
["mangle", "front", "-A ACL_OUTBOUND_%s -d 224.0.0.18/32 -j
ACCEPT" % self.dev])
+ self.fw.append(
+ ["mangle", "", "-A ACL_OUTBOUND_%s -j DROP" % self.dev])
+
self.fw.append(
["filter", "", "-A INPUT -i %s -p udp -m udp --dport 67 -j
ACCEPT" % self.dev])
self.fw.append(
@@ -717,4 +720,3 @@ def cpus(self):
if count < 2:
logging.debug("Single CPU machine")
return count
-
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
> Egress Rule in VPC ACL broken
> ------------------------------
>
> Key: CLOUDSTACK-10043
> URL: https://issues.apache.org/jira/browse/CLOUDSTACK-10043
> Project: CloudStack
> Issue Type: Bug
> Security Level: Public(Anyone can view this level - this is the
> default.)
> Components: Virtual Router, VPC, XenServer
> Affects Versions: 4.9.2.0
> Environment: Cloudstack 4.9.2.0
> XenServer 6.5SP1
> Zone with Advanced Network
> Reporter: Francois Scheurer
> Assignee: René Moser
> Priority: Blocker
>
> The Network Offering of the VPC Tier has a Default Egress Policy = Deny.
> Some Allow Rules exist in the ACL, but _ALL_ egress connections are possible.
> Creating a Deny All rule explicit at the end of the rules is actually
> blocking ALL traffic (should not, because of the Allow rules).
> The Iptables in the VR are wrong:
> 1) the allow & deny rules are in wrong order.
> 2) some rules are in mangle table instead of filter
> Do you know how to fix this?
> Thank you for your help.
> Francois Scheurer
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
