Page History

Bug Reference: CLOUDSTACK-763

ACL Deny Rules

Currently only ACL allow rules are supported as part of Network ACLs. Default is to block all incoming and all outgoing traffic between tiers and between tiers and various gateways (including Public)By default, all incoming traffic to guest networks is blocked. All outgoing traffic from guest networks is allowed, once you add an ACL rule for outgoing traffic, then only outgoing traffic specified in this ACL rule is allowed, the rest is blocked. ACL deny rules will be supported through this feature. New fields "number"  and "action"will be added to rules to resolve conflicting rules. After rule creation, its number can be modified. NetworkACLs will be evaluated in the order of its number starting from lowest. Action of the first matching rule is applied.  

NetworkACLContainer will be introduced to manage NetworkACLs.

NetworkACLContainer

NetworkACLList will be introduced to manage NetworkACLs (NetworkACLItems).

Terminology

ACL is Access Control List. So ACL container is kind of redundant. Instead we use the below terminology:

NetworkACLItem - Individual ACL Entry (was NetworlACL earlier). Should we call it NetworkAclEntry instead?

NetworkACL - Group of Network ACL Items. API will use the term NetworkACLList to differentiate from the existing NetworkACL APIs

NetworkACL

NetworkACLNetworkACLContainer is a numbered list of  NetworkACLs NetworkACLItems that are evaluated in order, starting with the lowest numbered rule, to determine whether traffic is allowed in or out of any tier associated with the network ACL.

Instead of adding NetworkACLs NetworkACLItems directly to the tier,NetworkACLs NetworkACLItems will be added to the NetworkACL. Tier will be associated with a NetworkACL at all times (default NetworkACL will be used when no ACL is associated. Default behavior will be deny all).

ACL is associated with a VPC and NetworkACLContainer. NetworkACLContainer can be assigned to multiple vpc VPC tiers within the VPC. Each tier can be associated with only one NetworkACLContainerone ACL. 

Default NetworkACLContainer

Each tier upon creation will be associated with default NetworkACLContainer.

Add/Remove networkACL networkACLItem to containerNetworkACL

NetworkACLs NetworkACLItems can be added or removed from the container using APIs addNetworkACLtoContainer, removeNetworkACLfromContainer  NetworkACL using APIs createNetworkACLItem and deleteNetworkACLItem APIs. Changes to ACL (add/update/remove aclItems) will be applied to all associated networks.

DefaultNetworkACL

Tier will be associated with default network acl when no ACL is associated. Default network ACL cannot be removed or modified. Contents of default network ACL:

Sample workflow

Creating Tier with default acl and assigning a custom acl later

1. Create VPC
2. Create Tier A - tier is associated with default network ACL
3. Create custom network ACL
4. Add ACLItems to the ACL
5. Assign ACL created in step # 3 to tier A using replaceNetworkACLList API

Create Tier with custom acl in 1 step

1. Create VPC
2. Create custom network ACL
3. Add ACLs to the ACL
4. Create Tier A with ACL created in step # 2

API changes

Existing API

createNetworkAclItem (Aliased to createNetworkACL) - async

Adds a networkACLItem to the specified ACL.createNetworkAcl

New parameters

• ** action(requiredoptional) - allow/deny - default allow
• number (requiredoptional) - rule number. ACL rules are ordered by this number. Default - current max number + 1
• aclId (optional) - id of the network ACL

For backward compatibility, if network_id is specified instead of acl_id, networkACLItem will added to the ACL assigned to the network.

deleteNetworkACLItem (Aliased to removeNetworkACL) - async

Deletes specifed network acl item from network ACL. No changes to the params. 

createNetwork

In VPC case, createNetwork is used to create a tier within VPC. Tier can be associated with a ACL during creation. If acl_id is not specified default ACL will be used. Network creation with acl_id will fail if ACL service is not present.

New parameters

• acl_id (optional) - id of the network ACL. Default NetworkACL will be used when not specified. 

new API

updateNetworkACLItem (aliased to updateNetworkACL) - async

Updates an existing NetworkACLItem

Parameters:

• **  id (required) - Id of the network ACL ACL Item
• ** trafficType (optional) - can be ingress/egress (defaulted to ingress if not specified)
• cidrlist (optional) - List of the coma separated CIDRs for the rule. If not specified, defaulted to 0.0.0.0/0
• startPort (optional)
• endPort (optional)
• protocol (optional). TCP/UDP/ICMP protocol types are supported
• icmpType (optional) - type of the icmp message being sent
• icmpCode (optional) - error code for this icmp message
• action (optional) - allow/deny
• number (optional) - rule number number

createNetworkAclList - sync

Creates network ACLcreateNetworkAclContainer

Parameters:

• name - Name of the Network Acl Container Acl (required)
• description - Description of the Network ACL Container ACL (required)
• vpcId - Id of the VPC (required)

Response:

• name - Name of the Network Acl Container
• id - Id uuid of the Network Acl ContainerdeleteNetworkAclContainerContainer
• description - Description of the Network ACL Container
• vpcId - VPC Id

deleteNetworkAclList - sync

Deletes network ACL. If the container is assigned to any network, deletion will fail. ACL should not contain any ACLItems for deletion to succeed.

Parameters:

• id - Id uuid of the Network Acl Container Acl (required)

Response:

• success - True if Network ACL container is successfully removed, false otherwise

listNetworkAclLists - sync

ACLs can be listed by id or tierlistNetworkAclContainers

Parameters:

• id - Id uuid of the Network Acl Container Acl (optional)
• network_id - list by network_id (Tier) (optional)

Response:

• success - True if Network ACL container is successfully removed, false otherwise

addNetworkACLtoContainer

Parameters:

• acl_id - Id of the network ACL (required)
• container_id: Id of the network ACL container (required)

Response

• success - True when ACL is successfully added to container, false otherwise 

removeNetworkACLfromContainer

Parameters:

• vpcId - list ACLs associated with specified vpc (optional)
• acl_item_id: List ACL containing specified acl_item_id

Response:

• List of network ACLs

replaceNetworkACLList - async

Assigns specified ACL to a tier (network)

Parameters:

• networkacl_id - Id of the network ACL (Tier) (required)
• containeracl_id: Id of the network ACL container to be associated with the network (required)

Response:

• success - True   True when ACL is successfully removed from containerassigned to network, false otherwise

replaceACLContainerAssociation

Parameters:

DB

New Tables

1. network_acl

• New Columns
  • id (long): auto-generated id
  • uuid (string): auto-generated uuid
  • account_id: Account to which the ACL belongs
  • vpc
• network_id - Id of the network (Tier) (required)
• container
  • _id: Id of the
  network ACL container to be associated with the network (required)

Response:

• success -  True when container is successfully assigned to network, false otherwise

DB

New columns in firewall_rules table:

• action (String)
• number (long)

action and number will be mandatory for rule with purpose NetworkACL.

Upgrade:

• • VPC
  • name: name of the network acl
  • description: network acl description

2. network_acl_item

• New columns
  • id
  • uuid
  • acl_id
  • action
  • number
  • traffic_type
  • start_port
  • end_port
  • protocol
  • state

Changes to existing tables

1. networks

• New Columns
  • acl_id (long) - network acl associated with this Tier

Scripts

vpc_acl.sh will be modified to support ACL deny rules. iptables rules will ACCEPT or DROP based on the ACL action. iptables rules will added in the order of the number starting from the lowest.

UI

UI changes are required to:

• Support ACL action and number
• Create Network ACL
• Add/Remove ACLItemss to Network ACL
• Assign Network ACL to a Tier

Upgrade

For each tier, a new network acl is created during the upgrade, All ACLItems that were assigned to this tier, will be part of the newly created network acl. If there are no ACLs for any tier, it'll be associated with the default ACL.

All existing rules in firewall_rules table of type NetworkACL will be moved to network_acl_item table and will have action "allow". Rule number will be sequentially assigned for all rules in each networktier.