Re: [I] ACL with multiple CIDRs does not honor rule id [cloudstack]

["fermosan (via GitHub)" <gi...@apache.org>]

fermosan commented on issue #12668:
URL: https://github.com/apache/cloudstack/issues/12668#issuecomment-6048604210

   I can reproduce this on a VPC virtual router (CloudStack 4.23.0.0, VR template <4.22.0>, KVM, iptables v1.8.9 (nf_tables)).
    
     Why a single multi-CIDR rule looks fine: it only goes wrong when the multi-CIDR rule is followed by other rules in the same ACL list. With just one rule there is nothing after it, so the order cannot be seen to be wrong.
    
     Setup: a tier ACL list with ingress rules such as 10 (allow tcp 80, 10.10.0.0/24,10.10.7.0/24), 12 (allow tcp 135, three CIDRs), 13 (allow tcp 443, 0.0.0.0/0), more single- and multi-CIDR rules, and a deny at 9998.
    
     Result on the VR (iptables -L ACL_INBOUND_eth9 -n -v --line-numbers, and the same for ACL_OUTBOUND_* in the mangle table):
     3   ACCEPT tcp 10.10.7.0/24  tcp dpt:80    <- only the LAST cidr of rule 10
     5   ACCEPT tcp 10.10.4.0/24  tcp dpt:135   <- only the LAST cidr of rule 12
     6   ACCEPT tcp 0.0.0.0/0     tcp dpt:443
     21  DROP                                   <- explicit deny (rule 9998)
     29  ACCEPT tcp 10.10.2.0/24  tcp dpt:135   <- other CIDRs of rule 12, behind the DROP
     30  ACCEPT tcp 10.10.0.10    tcp dpt:135
     31  ACCEPT tcp 10.10.0.0/24  tcp dpt:80    <- other CIDR of rule 10, behind the DROP
     32  DROP                                   <- the VR's own final DROP
     In every multi-CIDR rule only the last CIDR lands in the right place. The rest are appended after the explicit deny, so they never match. It happens in both ingress (filter) and egress (mangle). Single-CIDR rules are fine.
    
     Impact: allow rules silently stop working for all but one CIDR. A deny with several CIDRs (for example "block private ranges" placed before an internet allow) would end up after the allow and stop denying.
    
     Possible cause (from reading configure.py, not tested): AclDevice.process() raises the insert index by 1 per ACL rule, and AclRule.create() emits one -A <chain> -s a,b,c .... 
   
   iptables expands the comma-separated source into several  rules, so the tracked index drifts after every multi-CIDR rule, and CsNetfilter inserts "right before the DROP all" at the wrong position.
    
   Workaround: one CIDR per rule, as @bradh352 wrote.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org