VPC ACL list default_allow allows no IPv6 traffic on a dual-stack tier

Đang mở
  • Có gì không ổn?
#14,627 1 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
5/5
Thời gian dự kiến
Hơn một tuần
Mức phù hợp với người mới
35/100
Loại issue
Lỗi
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
java, linux, python, sql
Lĩnh vực
cloud, infrastructure, networking

Hướng nghiên cứu

Read schema-410to420.sql and configure.py, especially CsAcl.__process_ip6(), to trace how the built-in ACL rules reach the IPv6 chains. First clarify with the community whether default_allow is intended to permit IPv6, since the issue describes a potentially breaking upgrade change and an alternative documentation path. Done means the chosen behavior is implemented or documented and verified on a dual-stack tier.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

component:ipv6 ipv6
problem

The built-in default_allow network ACL list ("Default Network ACL Allow All") allows all IPv4 traffic but no IPv6 traffic. A dual-stack VPC tier that uses it gets no IPv6 ingress and no IPv6 egress through the VPC router.

Why:

  • The list is seeded in schema-410to420.sql with two items, all Ingress Allow and all Egress Allow, each with the single CIDR 0.0.0.0/0. No later upgrade adds ::/0 to them.
  • On the VPC router, CsAcl.__process_ip6() in configure.py removes the IPv4 CIDRs from each rule (removeUndesiredCidrs(cidr, 4)) and skips a rule that has none left. Both default_allow items are skipped. The tier's ip6 ip6_acl chains (<dev>_ingress_policy and <dev>_egress_policy) are left with only their closing drop rule.
  • The IPv4 side renders as expected: -j ACCEPT for all protocols in both directions.

default_deny is not affected in practice: its items also carry only 0.0.0.0/0 and are skipped on IPv6, and the chain still ends in drop.

This looks inconsistent with the rest of the ACL code, which treats "all addresses" as both families:

  • createNetworkACL without cidrlist creates the rule with 0.0.0.0/0 and ::/0 (since IPv6 VPC tiers were added in 4.17).
  • SetNetworkACLCommand sends 0.0.0.0/0,::/0 to the router for a rule that has no CIDR.

I'm not sure if this is meant to be this way. Opening up IPv6 on default_allow would change existing deployments on upgrade. A dual-stack tier's IPv6 addresses are reachable from outside without NAT, so every VM on a default_allow tier would become reachable over IPv6 on all ports. Whether that is what "Allow All" should mean for IPv6, or whether IPv6 should stay closed and the behaviour be documented, needs a decision from the community.

versions

4.17 and later (since IPv6 support for VPC tiers). Seen on 4.22 and main, with system VM template 4.22.0.

The steps to reproduce the bug
  1. Create a zone IPv6 guest prefix and a dual-stack VPC offering and dual-stack VPC tier network offering.
  2. Create a VPC and a tier on it with aclid set to default_allow. Deploy a VM on the tier.
  3. On the VPC router: nft list table ip6 ip6_acl. The tier's ingress and egress policy chains contain only the final drop rule. iptables -S shows the default_allow rules as ACCEPT for IPv4.
  4. From the VM, an IPv6 connection to an external address fails. An IPv6 connection to the VM from outside the VPC also fails. The same over IPv4 (with a static NAT or port forwarding for ingress) works.
What to do about it?

Two options, and I don't know which one is intended:

  1. Make default_allow allow IPv6 too. This needs an upgrade SQL that adds ::/0 to the two default_allow items (seed data, so main only). It opens IPv6 on every existing tier on that list at the next ACL apply, so it would need a release note.
  2. Keep IPv6 closed on default_allow, and document that a dual-stack tier needs its own ACL list with ::/0 rules. The list's description could say "IPv4" so it isn't mistaken for both families.
Ngôn ngữ chính
Java
Star
3.1k
Fork
1.4k
Merge trung bình
7 ngày 16 giờ
Pull request đã merge (30 ngày)
15

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của apache/cloudstack

Tất cả issue của apache/cloudstack

Issue tương tự

Thêm issue về Java

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.