IPv6 firewall: accept packets from related and established connections by winterhazel · Pull Request #10970 · apache/cloudstack

winterhazel · 2025-06-05T17:33:55Z

Description

The VR's firewall service automatically accepts packets from related and established connections when using IPv4. However, it does not for IPv6. Due to this, even if the egress rules allow a VM to send requests to a machine from outside the isolated network, it will not receive the response unless operators have allowed all ingress for the (sometimes dynamically allocated) port.

This PR adds a rule to the VR's IPv6 forward chain accepting response traffic (ingress from related and established connections), even if the operator has not explicitly allowed all ingress for the ports, thus matching the IPv4 firewall's behavior.

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

How Has This Been Tested?

I introduced an IPv6 range to my environment.
I created a network offering for IPv6.
I created an isolated network with the network offering.
I added a VM to the network.

Then, I performed the following tests:

I validated that the VR had nftables rules in the forward and input chains allowing the ingress of related packets and packets from established connections.
Inside the VM, I tried to download a file from a machine outside the isolated network using IPv6. I validated that the download did not begin, because the egress traffic was not allowed.
I allowed the egress for ports 80 and 443.
Inside the VM, I tried to download a file from a machine outside the isolated network using IPv6 again. This time, the file was download successfully. Before the changes, the file would not be downloaded, because the VR was rejecting the response traffic.
I tried to login into the VM using SSH and IPv6. I validated that it was not possible because the ingress traffic for port 22 was not allowed.
I allowed ingress for port 22, and tried to login into the VM using SSH and IPv6 one more time. This time, I was able to access the VM successfully.

…nnections

winterhazel · 2025-06-05T17:36:04Z

@blueorangutan package

codecov · 2025-06-05T17:41:53Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 16.15%. Comparing base (823080c) to head (145f4fe).
⚠️ Report is 130 commits behind head on 4.20.

Additional details and impacted files

@@            Coverage Diff             @@
##               4.20   #10970    +/-   ##
==========================================
  Coverage     16.14%   16.15%            
- Complexity    13253    13269    +16     
==========================================
  Files          5656     5657     +1     
  Lines        497893   497772   -121     
  Branches      60374    60364    -10     
==========================================
+ Hits          80405    80408     +3     
+ Misses       408529   408413   -116     
+ Partials       8959     8951     -8

Flag	Coverage Δ
uitests	`4.00% <ø> (-0.01%)`	⬇️
unittests	`17.00% <ø> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

weizhouapache · 2025-06-05T18:01:06Z

oh, I remember this issue, I had a fix more than one year ago.
I thought I have created a PR for it 🤦‍♂️

good finding @winterhazel
the code is different from mine (4 lines), but the idea is the same

DaanHoogland · 2025-06-09T14:25:09Z

@weizhouapache , does that mean lgty?

JoaoJandre · 2025-07-04T17:36:54Z

@blueorangutan package

blueorangutan · 2025-07-04T17:38:03Z

@JoaoJandre a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-07-04T19:14:21Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 14043

winterhazel · 2025-07-08T17:01:42Z

@blueorangutan package

blueorangutan · 2025-07-08T17:04:03Z

@winterhazel a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-07-08T18:47:39Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 14105

weizhouapache

code lgtm

Not tested it yet

DaanHoogland · 2025-07-09T12:40:03Z

@blueorangutan test

blueorangutan · 2025-07-09T12:42:03Z

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-07-10T05:01:15Z

[SF] Trillian test result (tid-13739)
Environment: kvm-ol8 (x2), Advanced Networking with Mgmt server ol8
Total time taken: 55694 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr10970-t13739-kvm-ol8.zip
Smoke tests completed. 141 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

shwstppr

code lgtm

weizhouapache · 2025-09-04T16:23:24Z

@blueorangutan package

blueorangutan · 2025-09-04T16:24:03Z

@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-09-04T19:38:58Z

Packaging result [SF]: ✔️ el8 ✖️ el9 ✔️ debian ✖️ suse15. SL-JID 14852

weizhouapache · 2025-09-04T19:47:24Z

@blueorangutan test

blueorangutan · 2025-09-04T19:48:06Z

@weizhouapache a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-09-04T20:13:56Z

[SF] Trillian Build Failed (tid-14212)

weizhouapache · 2025-09-05T05:52:54Z

@blueorangutan package

blueorangutan · 2025-09-05T05:54:14Z

@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-09-05T08:16:57Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 14868

DaanHoogland · 2025-09-08T13:07:13Z

@blueorangutan test

blueorangutan · 2025-09-08T13:08:04Z

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

weizhouapache · 2025-09-10T14:37:08Z

Tested with Ipv6 network and VPC

SSH did not work prior to this change, it worked with this change

an example of nft rules

        chain fw_forward {
                type filter hook forward priority filter; policy accept;
                ct state established,related accept
                ip6 saddr 2025:9:10:e::/64 jump fw_chain_egress
                ip6 daddr 2025:9:10:e::/64 jump fw_chain_ingress
        }

apache#10970) * IPv6 firewall: accept related packets and packets from established connections * Remove rule from input chain

…ted connections The systemvm Virtual Router's nftables `ip6 ip6_firewall fw_input` chain is created with policy=drop and only ICMPv6 accept rules. The IPv4 INPUT chain has the equivalent `iifname "eth2" ct state established,related accept` rule (added by `fw_router_routing()`); the IPv6 path has no such rule. Effect: any v6 connection the VR itself initiates outbound (BGP to upstream PE peers, NTP, DNS lookups, etc.) has its return traffic silently dropped at the v6 INPUT hook before TCP processes it. For Isolated v6 ROUTED networks this is fatal — BGP IPv6 sessions cannot establish, tenant /64 prefixes are never advertised upstream, and VMs in the network are unreachable from the IPv6 internet. PR apache#10970 added the equivalent rule to the FORWARD chain only (covering tenant VM return traffic). This commit adds the matching rule to the INPUT chain (covering VR-originated return traffic) by introducing `fw_router_routing_v6()` as the IPv6 mirror of `fw_router_routing()`. Verified end-to-end on ACS 4.22.0.0 KVM: before the patch, v6 BGP sessions stay in `Connect` indefinitely; tcpdump confirms PE responds with SYN-ACK but VR's TCP stack never sees the SYN-ACK (MD5 counters zero — drop happens at netfilter). After the patch, v6 BGP sessions reach `Established` within seconds and remain stable across subsequent tenant firewall rule updates. Fixes: apache#13171 Signed-off-by: Jason Ball <jball@resetdata.com>

The IPv6 fw_input chain currently accepts only ICMPv6 control traffic and policy=drop everything else. Return traffic for VR-initiated v6 connections (e.g. BGP SYN-ACKs from upstream peers) is silently dropped. PR apache#10970 added the equivalent rule to the v6 FORWARD chain but removed it from INPUT in its second commit. This restores it at chain creation, so it applies uniformly to all v6 input-hook chains (routed Isolated, non-routed Isolated, etc.). Tested on ACS 4.22.0.0 staging: - Routed Isolated v6 (IsolatedV6RoutedFiltered offering): BGP v6 sessions reach Established, tenant /64 advertised upstream. - Non-routed Isolated v6 (DualStack with VirtualRouter + SourceNat): fw_input contains the established/related accept rule and accepts return traffic. Resulting fw_input on both shapes: chain fw_input { type filter hook input priority filter; policy drop; icmpv6 type { ... } accept ct state established,related accept } Fixes: apache#13171 Refs: apache#10970 Co-authored-by: Bryan Lima <[email protected]> Signed-off-by: Jason Ball <jball@resetdata.com>

IPv6 firewall: accept related packets and packets from established co…

0b0fe28

…nnections

boring-cyborg Bot added component:networking component:virtual-router Python Warning... Python code Ahead! labels Jun 5, 2025

winterhazel requested review from shwstppr and weizhouapache June 5, 2025 17:36

weizhouapache reviewed Jul 4, 2025

View reviewed changes

Comment thread systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py Outdated

Remove rule from input chain

145f4fe

weizhouapache approved these changes Jul 9, 2025

View reviewed changes

DaanHoogland added the status:needs-testing label Jul 10, 2025

winterhazel added this to the 4.20.2 milestone Jul 16, 2025

shwstppr approved these changes Sep 3, 2025

View reviewed changes

weizhouapache self-assigned this Sep 3, 2025

weizhouapache merged commit 5d32492 into apache:4.20 Sep 10, 2025
26 checks passed

DaanHoogland removed the status:needs-testing label Jan 28, 2026

khumps mentioned this pull request Apr 4, 2026

[BUG] fw_chain_egress missing ct state established,related accept causes inbound TCP to fail with default egress deny on routed networks #12962

Closed

weizhouapache mentioned this pull request Apr 8, 2026

Routed VR: accept packets from related and established connections #12986

Merged

14 tasks

jball-resetdata mentioned this pull request May 17, 2026

IPv6 ROUTED Filtered networks: VR's ip6_firewall fw_input chain missing 'ct state established,related accept' rule — IPv6 BGP cannot establish #13171

Closed

agronaught mentioned this pull request May 17, 2026

systemvm: ipv6 fw_input — accept return traffic from established,rela… #13173

Merged

14 tasks

Conversation

winterhazel commented Jun 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

How Has This Been Tested?

Uh oh!

winterhazel commented Jun 5, 2025

Uh oh!

codecov Bot commented Jun 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

weizhouapache commented Jun 5, 2025

Uh oh!

DaanHoogland commented Jun 9, 2025

Uh oh!

JoaoJandre commented Jul 4, 2025

Uh oh!

blueorangutan commented Jul 4, 2025

Uh oh!

blueorangutan commented Jul 4, 2025

Uh oh!

Uh oh!

winterhazel commented Jul 8, 2025

Uh oh!

blueorangutan commented Jul 8, 2025

Uh oh!

blueorangutan commented Jul 8, 2025

Uh oh!

weizhouapache left a comment

Choose a reason for hiding this comment

Uh oh!

DaanHoogland commented Jul 9, 2025

Uh oh!

blueorangutan commented Jul 9, 2025

Uh oh!

blueorangutan commented Jul 10, 2025

Uh oh!

shwstppr left a comment

Choose a reason for hiding this comment

Uh oh!

weizhouapache commented Sep 4, 2025

Uh oh!

blueorangutan commented Sep 4, 2025

Uh oh!

blueorangutan commented Sep 4, 2025

Uh oh!

weizhouapache commented Sep 4, 2025

Uh oh!

blueorangutan commented Sep 4, 2025

Uh oh!

blueorangutan commented Sep 4, 2025

Uh oh!

weizhouapache commented Sep 5, 2025

Uh oh!

blueorangutan commented Sep 5, 2025

Uh oh!

blueorangutan commented Sep 5, 2025

Uh oh!

DaanHoogland commented Sep 8, 2025

Uh oh!

blueorangutan commented Sep 8, 2025

Uh oh!

weizhouapache commented Sep 10, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

winterhazel commented Jun 5, 2025 •

edited

Loading

codecov Bot commented Jun 5, 2025 •

edited

Loading