updateNetworkACLItem with partialupgrade=false leaves a rule broken when cidrlist or traffictype is left out, and drops an ICMP type given with tcp

未關閉
  • 哪裡不對？
#14,642 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

@bhouse-nexthop 已經在處理了。

開始於 2026年11月9日。

  • #14643 來自 @bhouse-nexthop —— 未關閉

評估

難度
4/5
預估耗時
3-5 天
新手友好度
42/100
Issue 類型
缺陷
描述清晰度
描述清楚
活躍度
活躍
技術堆疊
java
領域
backend-api-design, cloud

研究方向

Start by reading updateNetworkACLItem, transferDataToNetworkAclRulePojo(), NetworkACLItemDaoImpl.update() and NetworkACLItemCidrsDaoImpl.updateCidrs(); trace validation alongside createNetworkACL and the default partial upgrade path. Check the existing tests for network ACL rule updates and add coverage for missing required fields, invalid traffic type, ICMP parameters with another protocol, and rollback when CIDR updates fail. Done means invalid calls fail before leaving a partial update and valid calls preserve the documented behavior.

由索引模型根據 Issue 內容生成。

描述

problem

updateNetworkACLItem with partialupgrade=false replaces every field of the rule with what the call passes. Two cases go wrong.

1. A field left out is written as null, and the rule is left broken.

When cidrlist or traffictype is left out, transferDataToNetworkAclRulePojo() sets them to null. NetworkACLItemDaoImpl.update() then writes the rule row and only afterwards updates the CIDRs, outside a transaction:

  • with cidrlist left out, NetworkACLItemCidrsDaoImpl.updateCidrs() fails with Cannot invoke "java.util.List.size()" because "cidrs" is null. The call fails, but the row has already been committed with the null traffic type.
  • from then on listNetworkACLs for that list fails with Cannot invoke "...TrafficType.toString()" because ... getTrafficType() is null, and applying the list fails the same way in SetNetworkACLCommand, until the rule is updated again with every field.

When protocol is left out, the call fails earlier with a NullPointerException in updateIcmpCodeAndTypeFullUpgrade(). Nothing is written in that case, but the error is an NPE rather than a message. (#14046 removes that NPE; the rule would then be saved without a protocol, which createNetworkACL never allows.)

action left out is already handled: it becomes Allow, as on create.

2. An ICMP type or code given with another protocol is silently dropped.

partialupgrade=false protocol=tcp icmptype=8 is accepted, and the rule is saved as tcp without the ICMP type. createNetworkACL with the same parameters, and the same update with the default partialupgrade=true, both refuse it with "Can specify icmpCode and icmpType for ICMP protocol only".

versions

4.20 and later for the dropped ICMP type; the null fields since partialupgrade was added in 4.12. Seen on 4.22 and main.

The steps to reproduce the bug
  1. In a VPC, create an ACL list and a rule on it: createNetworkACL aclid=<list> protocol=tcp startport=80 endport=80 cidrlist=10.1.2.0/24 action=allow traffictype=ingress.
  2. updateNetworkACLItem id=<rule> partialupgrade=false protocol=udp startport=53 endport=53. It fails with the cidrs is null NPE.
  3. listNetworkACLs aclid=<list> now fails with the getTrafficType() is null NPE.
  4. updateNetworkACLItem id=<rule> partialupgrade=false protocol=tcp cidrlist=10.1.2.0/24 action=allow traffictype=ingress repairs it.
  5. On an ICMP rule, updateNetworkACLItem id=<rule> partialupgrade=false protocol=tcp icmptype=8 cidrlist=10.1.2.0/24 action=allow traffictype=ingress is accepted, and the rule is tcp with no ICMP type.
What to do about it?
  • With partialupgrade=false, refuse the call when protocol, cidrlist or traffictype is missing, before anything is written. Defaulting them as create does would silently widen a rule to every address, or turn an egress rule into an ingress rule.
  • Refuse an invalid traffictype on update, as create does, instead of ignoring it.
  • Keep an ICMP type or code given with another protocol, so that the existing validation refuses it.
  • Write the rule row and its CIDRs in one transaction, so that a failure on the CIDRs can't leave the rule half updated.
主要語言
Java
星號
3.1k
分支
1.4k
平均合併
7 天 16 小時
30 天內合併 PR
15

環境準備

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

apache/cloudstack 的其他 Issue

查看 apache/cloudstack 的全部 Issue

相似的 Issue

更多 Java Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。