search

google / capirca

Multi-platform ACL generation system
Apache License 2.0
778 stars 209 forks source link

NSX-T plugin generates invalid payload: netblocks including 0.0.0.0/anything, port ranges consisting of one port #348

Closed ivucica closed 1 year ago

ivucica commented 1 year ago

0.0.0.0/[anything] is rejected with HTTP 400:

Invalid IP address value provided 0.0.0.0/0

Web UI also rejects 0.0.0.0/8 with the same message. If /0 is the sole member of source_groups or destination_groups, it is easy to deal with: we can just use ANY. However, if we have 0.0.0.0/8 as a, for example, part of set subtraction, then this is not the right way out. I'd say it's a bug in NSX-T to not support these use cases: it will happily accept 0.0.0.1 as a valid IP, but not as a part of the subnet spec.

Additionally, if we have port range consisting of one port (e.g. 1234-1234) this will get rejected, and 1234 should be submitted. Otherwise we get this HTTP 400 error (it was guesswork which of the rules caused it, but it looks like 1234-1234 was the culprit).

Invalid port provided while creating/updating Service / ServiceEntry.
ivucica commented 1 year ago

Internal code change created which should resolve the immediate pain of these two issues. Once submitted internally, it should be published externally too.

ivucica commented 1 year ago

Fixed in 9e9812ed78b7c70bc6137ecd956f3ff6c460f214