apache / apache/cloudstack

VMs with security groups allowing all egress traffic cannot access the Internet in 4.23.0.0

未關閉
#14,099 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
bug
主要語言
Java
星號
3.1k
分支
1.4k
平均合併
6 天 19 小時
30 天內合併 PR
32

描述

### problem

# Description

In CloudStack 4.23.0.0, a VM cannot access the Internet when its security group has egress rules configured, even when the egress rules allow all outbound traffic (0.0.0.0/0).

The same configuration works as expected in older CloudStack versions.

The issue occurs when the security group has egress rules but no ingress rules.

# Expected behavior

The VM should be able to initiate outbound connections to the Internet when the security group has an egress rule allowing all traffic.

According to the CloudStack documentation:
```
If there is no Egress rule in a Security Group, all the outgoing traffic will be allowed.
If there are Egress rules in a Security Group, only the outgoing traffic which match a Egress rule will be allowed.
Only the incoming traffic which match a Ingress rule will be allowed.
```

# Actual behavior

With CloudStack 4.23.0.0:

- The VM has a security group assigned.
- The security group has one egress rule allowing ALL outbound traffic.
- There are no ingress rules.
- The VM cannot access the Internet.

Image

Image

### versions

The versions of ACS, hypervisors, storage, network etc..

### The steps to reproduce the bug

1.
2.
3.
...

### What to do about it?

_No response_

貢獻指南

開啟貢獻指南

研究方向

未識別出檔案、測試或進入點。首先使用允許 0.0.0.0/0 的僅出站安全性群組重現 4.23.0.0 案例,接著將其與較舊的正常運作版本進行比較,並追蹤安全性群組的出站路徑。當 VM 可以在沒有任何入站規則的情況下發起 Internet 連線,且相關回歸已由測試涵蓋時,即表示完成。

由索引模型根據 Issue 內容生成。

評估

技術堆疊
java
領域
cloud, networking, security
Issue 類型
缺陷
難度
4/5
預估耗時
3-5 天
活躍度
活躍
描述清晰度
需要釐清
新手友好度
45/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。