[ https://issues.apache.org/jira/browse/CLOUDSTACK-10200?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
IGOR VOLOSHANENKO resolved CLOUDSTACK-10200. -------------------------------------------- Resolution: Fixed > ACL not applied for PrivateGateway inside ACL_INBOUND/OUTBOUND chains. > Traffic blocked by next DROP rule > -------------------------------------------------------------------------------------------------------- > > Key: CLOUDSTACK-10200 > URL: https://issues.apache.org/jira/browse/CLOUDSTACK-10200 > Project: CloudStack > Issue Type: Bug > Security Level: Public(Anyone can view this level - this is the > default.) > Components: Virtual Router > Affects Versions: 4.9.0, 4.10.0.0, 4.11.0.0 > Environment: CloudStack with advanced network installation > Reporter: IGOR VOLOSHANENKO > Labels: pull-request-available > Fix For: Future, 4.11.0.0 > > > We found bug in ACL rules for PrivateGateway for VPC > At a glance - rules not applied - switching Allow All or Deny All (default > ACL) - showed as completed - but rules missed. > Result - traffic via PrivateGateway blocked by next DROP rule in next chains > How to reproduce: > 1. Enable PrivateGateway for Cloudstack > 2. Create VPC > 3. Provision new PrivateGateway inside VPC with some VLAN > 4. Change ACL (optional step to show that problem not in initial > configuration but in config itself) > Expected: > ACL rules applied (inserted) into correspondig ACL_INBOUND/OUTBOUND chanins > for PrivateGateway interface (ethX) based on ACL which user choose > Current: > No rules inserted. ACL_INBOUND/OUTBOUND_ethX - empty. Traffic blocked by next > DROP rule in FORWARD chain > Affect - all our corporate customers blocked with access to their own nets > via PG and vice-versa. > Root cause: > Issue happened because of CsNetFilter.py logic for inserting rules for > ACL_INBOUND/OUTBOUND chains. > We choose rule numebr to isnert right before last DROP rule - but forget > about fact - that if chain empty - we also return 0 as insert position. Which > not true for iptables - numeration started from 0. > So we need very small patch to handle this special case - if number of rules > inside chain equal to zero - return 1, else - return count of rules inside > chain. > It's found only one - just because be default for PrivateGateway - we didn't > insert any "service rules" (if SourceNat for PrivateGteway not ticked) - and > we have by default empty ACL_INBOUND/OUTBOUND chains. Because same insert > happened for all VPC networks (but when we call this insert - we already have > at least 1 rule inside chains - and we successfully can process) > https://github.com/apache/cloudstack/pull/2367 -- This message was sent by Atlassian JIRA (v6.4.14#64029)