search

F5Networks / f5-appsvcs-extension

F5 BIG-IP Application Services 3 Extension
Apache License 2.0
163 stars 52 forks source link

SNAT translation address is still referenced by SNAT #822

Open Darius-Solarian opened 2 months ago

Darius-Solarian commented 2 months ago

Environment

Summary

It appears we are running into another race condition that is causing the same bug that was experienced in https://github.com/F5Networks/f5-appsvcs-extension/issues/761 on the 3.48.0 and 3.50.0 versions. We were previously on 3.46 and proceeded to upgrade to 3.50.2 based on seeing that the fix was provided in 3.48.0. However, the problem still occurs even after the upgrade.

Steps To Reproduce

Steps to reproduce the behavior: ??? This issue has been occuring for us for quite a long while and was never fully investigated when it first initially occurred, so reproduction steps are currently unknown.

However, is our best attempt at what can be done, beyond what was already defined in Issue 761 that we are referring to. 1) Creation of SNAT pools inside of an iApp, where the SNAT translation is implicitly defined by the system. 2) Deployment of the following AS3 definition: oma_SELFSERV_DEVQA_VERIFY_ltm.json 3) See the following message first

{
    "id": "5681e803-c031-4214-b059-35150addc0f5",
    "results": [
        {
            "message": "Declaration successfully submitted",
            "tenant": "",
            "host": "",
            "runTime": 0,
            "code": 0
        }
    ],
    "declaration": {},
    "selfLink": "https://localhost/mgmt/shared/appsvcs/task/5681e803-c031-4214-b059-35150addc0f5"
}

4) Watch the task until it completes.. and comes up a behavior like the following:

{
    "id": "5681e803-c031-4214-b059-35150addc0f5",
    "results": [
        {
            "code": 200,
            "message": "success",
            "lineCount": 48,
            "host": "localhost",
            "tenant": "Common",
            "runTime": 34137
        },
        {
            "code": 422,
            "message": "declaration failed",
            "response": "01071468:3: SNAT translation address (/Common/77.55.44.33) is still referenced by SNAT (/Common/application.app/application-snat).",
            "host": "localhost",
            "tenant": "Common",
            "runTime": 34139
        }
    ],
    "declaration": {
        "Common": {
            "class": "Tenant",
            "Shared": {
                "class": "Application",
                "template": "shared",
                "csg-old-default-serverssl-ciphers": {
                    "class": "Cipher_Group",
                    "allowCipherRules": [
                        {
                            "use": "HIGH"
                        }
                    ],
                    "excludeCipherRules": [
                        {
                            "use": "ADH"
                        }
                    ],
                    "requireCipherRules": [],
                    "order": "default"
                },
                "csg-old-dev-cxp-router-ciphers": {
                    "class": "Cipher_Group",
                    "allowCipherRules": [
                        {
                            "use": "HIGH"
                        },
                        {
                            "use": "AES"
                        }
                    ],
                    "excludeCipherRules": [
                        {
                            "use": "ADH"
                        }
                    ],
                    "requireCipherRules": [],
                    "order": "default"
                },
                "csg-old-default-clientssl-ciphers": {
                    "class": "Cipher_Group",
                    "allowCipherRules": [
                        {
                            "use": "HIGH"
                        },
                        {
                            "use": "AES"
                        },
                        {
                            "use": "threeDES"
                        }
                    ],
                    "excludeCipherRules": [
                        {
                            "use": "ADH"
                        }
                    ],
                    "requireCipherRules": [],
                    "order": "default"
                },
                "csg-old-rabbitmq-pmgout-ciphers": {
                    "class": "Cipher_Group",
                    "allowCipherRules": [
                        {
                            "use": "HIGH"
                        },
                        {
                            "use": "AES"
                        },
                        {
                            "use": "threeDES"
                        }
                    ],
                    "excludeCipherRules": [
                        {
                            "use": "ADH"
                        },
                        {
                            "use": "SSLv3"
                        },
                        {
                            "use": "DTLSv1"
                        },
                        {
                            "use": "TLSv1"
                        },
                        {
                            "use": "TLSv1_1"
                        }
                    ],
                    "requireCipherRules": [],
                    "order": "default"
                },
                "csg-old-chase-outrouter-serverssl-ciphers": {
                    "class": "Cipher_Group",
                    "allowCipherRules": [
                        {
                            "use": "HIGH"
                        }
                    ],
                    "excludeCipherRules": [
                        {
                            "use": "ADH"
                        },
                        {
                            "use": "SSLv3"
                        },
                        {
                            "use": "DTLSv1"
                        },
                        {
                            "use": "TLSv1"
                        },
                        {
                            "use": "TLSv1_1"
                        }
                    ],
                    "requireCipherRules": [],
                    "order": "default"
                },
                "csg-old-srysrv-default-ciphers": {
                    "class": "Cipher_Group",
                    "allowCipherRules": [
                        {
                            "use": "DEFAULT"
                        }
                    ],
                    "excludeCipherRules": [
                        {
                            "use": "RC4"
                        }
                    ],
                    "requireCipherRules": [],
                    "order": "default"
                },
                "csg-secure-ciphers": {
                    "class": "Cipher_Group",
                    "allowCipherRules": [
                        {
                            "use": "TLSv1_2"
                        },
                        {
                            "use": "TLSv1_3"
                        }
                    ],
                    "excludeCipherRules": [
                        {
                            "use": "CBC"
                        },
                        {
                            "use": "DES"
                        },
                        {
                            "use": "RC4"
                        },
                        {
                            "use": "threeDES"
                        },
                        {
                            "use": "ADH"
                        }
                    ],
                    "requireCipherRules": [],
                    "order": "default"
                },
                "csg-strong-secure-ciphers": {
                    "class": "Cipher_Group",
                    "allowCipherRules": [
                        {
                            "use": "TLSv1_2"
                        },
                        {
                            "use": "TLSv1_3"
                        }
                    ],
                    "excludeCipherRules": [
                        {
                            "use": "CBC"
                        },
                        {
                            "use": "DES"
                        },
                        {
                            "use": "RC4"
                        },
                        {
                            "use": "threeDES"
                        },
                        {
                            "use": "ADH"
                        },
                        {
                            "use": "secure-but-weak"
                        }
                    ],
                    "requireCipherRules": [],
                    "order": "default"
                },
                "CBC": {
                    "class": "Cipher_Rule",
                    "cipherSuites": [
                        "DHE-RSA-AES128-SHA256",
                        "DHE-RSA-AES256-SHA256",
                        "DHE-RSA-CAMELLIA256-SHA",
                        "ECDHE-RSA-DES-CBC3-SHA",
                        "ECDHE-RSA-AES128-SHA256",
                        "ECDHE-RSA-AES256-SHA384",
                        "AES128-SHA256",
                        "AES256-SHA256",
                        "CAMELLIA256-SHA",
                        "AES256-GCM-SHA384",
                        "ECDHE-RSA-AES128-CBC-SHA",
                        "ECDHE-RSA-AES256-CBC-SHA"
                    ],
                    "namedGroups": [],
                    "signatureAlgorithms": []
                },
                "secure-but-weak": {
                    "class": "Cipher_Rule",
                    "cipherSuites": [
                        "AES128-GCM-SHA256",
                        "AES128-SHA",
                        "AES256-SHA",
                        "CAMELLIA128-SHA",
                        "ECDHE-ECDSA-AES128-SHA",
                        "ECDHE-ECDSA-AES128-SHA256",
                        "ECDHE-ECDSA-AES256-SHA",
                        "ECDHE-ECDSA-AES256-SHA384",
                        "DHE-RSA-AES128-SHA",
                        "DHE-RSA-AES256-SHA",
                        "DHE-RSA-CAMELLIA128-SHA",
                        "DHE-DSS-AES128-SHA",
                        "DHE-DSS-AES256-SHA",
                        "DHE-DSS-AES256-SHA256",
                        "DHE-DSS-CAMELLIA128-SHA",
                        "DHE-DSS-CAMELLIA256-SHA"
                    ],
                    "namedGroups": [],
                    "signatureAlgorithms": []
                },
                "AES": {
                    "class": "Cipher_Rule",
                    "cipherSuites": [
                        "AES"
                    ],
                    "namedGroups": [],
                    "signatureAlgorithms": []
                },
                "ADH": {
                    "class": "Cipher_Rule",
                    "cipherSuites": [
                        "ADH"
                    ],
                    "namedGroups": [],
                    "signatureAlgorithms": []
                },
                "DEFAULT": {
                    "class": "Cipher_Rule",
                    "cipherSuites": [
                        "DEFAULT"
                    ],
                    "namedGroups": [],
                    "signatureAlgorithms": []
                },
                "DES": {
                    "class": "Cipher_Rule",
                    "cipherSuites": [
                        "DES"
                    ],
                    "namedGroups": [],
                    "signatureAlgorithms": []
                },
                "DTLSv1": {
                    "class": "Cipher_Rule",
                    "cipherSuites": [
                        "DTLSv1"
                    ],
                    "namedGroups": [],
                    "signatureAlgorithms": []
                },
                "HIGH": {
                    "class": "Cipher_Rule",
                    "cipherSuites": [
                        "HIGH"
                    ],
                    "namedGroups": [],
                    "signatureAlgorithms": []
                },
                "RC4": {
                    "class": "Cipher_Rule",
                    "cipherSuites": [
                        "RC4"
                    ],
                    "namedGroups": [],
                    "signatureAlgorithms": []
                },
                "SSLv3": {
                    "class": "Cipher_Rule",
                    "cipherSuites": [
                        "SSLv3"
                    ],
                    "namedGroups": [],
                    "signatureAlgorithms": []
                },
                "threeDES": {
                    "class": "Cipher_Rule",
                    "cipherSuites": [
                        "3DES"
                    ],
                    "namedGroups": [],
                    "signatureAlgorithms": []
                },
                "TLSv1_1": {
                    "class": "Cipher_Rule",
                    "cipherSuites": [
                        "TLSv1_1"
                    ],
                    "namedGroups": [],
                    "signatureAlgorithms": []
                },
                "TLSv1_2": {
                    "class": "Cipher_Rule",
                    "cipherSuites": [
                        "TLSv1_2"
                    ],
                    "namedGroups": [],
                    "signatureAlgorithms": []
                },
                "TLSv1_3": {
                    "class": "Cipher_Rule",
                    "cipherSuites": [
                        "TLSv1_3"
                    ],
                    "namedGroups": [],
                    "signatureAlgorithms": []
                },
                "TLSv1": {
                    "class": "Cipher_Rule",
                    "cipherSuites": [
                        "TLSv1"
                    ],
                    "namedGroups": [],
                    "signatureAlgorithms": []
                }
            }
        },
        "class": "ADC",
        "schemaVersion": "3.34.0",
        "id": "autogen_bb1f68b5-6836-40c6-a708-8521730a0534",
        "updateMode": "selective",
        "controls": {
            "archiveTimestamp": "2024-04-18T21:54:09.329Z"
        }
    }
}

Expected Behavior

I expect AS3 to successfully deploy and remove any configurations that are tied only to AS3.

Actual Behavior

AS3's transaction fails to deploy and remove the configurations under its control as it attempts to remove SNAT Translations that have never been defined by it and are currently in use and defined by iApp services and templates.