VMs with security groups allowing all egress traffic cannot access the Internet in 4.23.0.0
- 主要語言
- Java
- 星號
- 3.1k
- 分支
- 1.4k
- 平均合併
- 6 天 19 小時
- 30 天內合併 PR
- 32
描述
### problem
# Description
In CloudStack 4.23.0.0, a VM cannot access the Internet when its security group has egress rules configured, even when the egress rules allow all outbound traffic (0.0.0.0/0).
The same configuration works as expected in older CloudStack versions.
The issue occurs when the security group has egress rules but no ingress rules.
# Expected behavior
The VM should be able to initiate outbound connections to the Internet when the security group has an egress rule allowing all traffic.
According to the CloudStack documentation:
```
If there is no Egress rule in a Security Group, all the outgoing traffic will be allowed.
If there are Egress rules in a Security Group, only the outgoing traffic which match a Egress rule will be allowed.
Only the incoming traffic which match a Ingress rule will be allowed.
```
# Actual behavior
With CloudStack 4.23.0.0:
- The VM has a security group assigned.
- The security group has one egress rule allowing ALL outbound traffic.
- There are no ingress rules.
- The VM cannot access the Internet.
### versions
The versions of ACS, hypervisors, storage, network etc..
### The steps to reproduce the bug
1.
2.
3.
...
### What to do about it?
_No response_
貢獻指南
研究方向
未識別出檔案、測試或進入點。首先使用允許 0.0.0.0/0 的僅出站安全性群組重現 4.23.0.0 案例,接著將其與較舊的正常運作版本進行比較,並追蹤安全性群組的出站路徑。當 VM 可以在沒有任何入站規則的情況下發起 Internet 連線,且相關回歸已由測試涵蓋時,即表示完成。
由索引模型根據 Issue 內容生成。
評估
- 技術堆疊
- java
- 領域
- cloud, networking, security
- Issue 類型
- 缺陷
- 難度
- 4/5
- 預估耗時
- 3-5 天
- 活躍度
- 活躍
- 描述清晰度
- 需要釐清
- 新手友好度
- 45/100