Fix a number of issues in AWS network ACLs #1843
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
resourceAwsNetworkAclRead swallowed these errors resulting in rules that never properly updated. Implement an entry-to-maplist function that'll allow us to write something that Set knows how to read.
AWS includes default rules with all network ACL resources which cannot be modified by the user. Don't attempt to store them locally or change them remotely if they are already stored -- it'll consistently result in hashing problems.
…1 protocol AWS doesn't store ports for -1 protocol rules, thus the read from the API will always come up with a different hash. Force the user to make a deliberate port choice when enabling -1 protocol rules. All from_port and to_port's on these rules must be 0.
AWS will accept any overly-specific IP/mask combination, such as 10.1.2.2/24, but will store it by its implied network: 10.1.2.0/24. This results in hashing errors, because the remote API will return hashing results out of sync with the local configuration file. Enforce a stricter API rule than AWS. Force users to use valid masks, and run a quick calculation on their input to discover their intent.
Users can input a limited number of protocol names (e.g. "tcp") as inputs to network ACL rules, but the API only supports valid protocol number: http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml Preserve the convenience of protocol names and simultaneously support numbers by only writing numbers to the state file. Also use numbers when hashing the rules, to keep everything consistent.
ctiwald
force-pushed
the
ct/fix-network-acls
branch
from
8eafb3e to
0688431
Compare
catsby
added a commit
that referenced
this pull request
May 7, 2015
Fix a number of issues in AWS network ACLs
|
Thanks @ctiwald ! Great work here |
|
Happy to help the cause. |
|
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further. |
ghost
locked and limited conversation to collaborators
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Turns out network ACLs weren't working quite right. They had four distinct hashing problems all of which were masked by #1808.
Not anymore. This PR should fix all of them. I recommend reviewing it by commit, rather than by the total file changed diff, as they're logically separated.