[VCL-996] Linux firewall subroutines do not sort rule numbers correctly

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.4.2
• Fix Version/s: 2.5
• Component/s: vcld (backend)
• Assignee: Andrew Kurth
• Reporter: Andrew Kurth
• Created: 12/Oct/16 19:22
• Updated: 12/Oct/16 20:09
• Resolved: 12/Oct/16 20:09

Description

The enable_firewall_port and disable_firewall_port subroutines in Linux.pm retrieve the existing iptables rules. The proper scope is then calculated. They then construct a long command that deletes existing rules with iptables -D then add rules back with iptables -I. All of the individual iptables commands are chained by &&. Example:

iptables -D INPUT 4 && iptables -D INPUT 3 && iptables -D INPUT 2 && iptables -v -I INPUT 1 -p tcp...

Existing rules are deleted by rule ID. It is critical to delete them in order from highest to lowest otherwise the ID of subsequent rules will change. For example, suppose you want to delete rules B, C and D which currently have IDs 2, 3 and 4:

1. A
2. B
3. C
4. D
5. E
6. F

If the rules are deleted in ascending order (2,3,4), after the first deletion (B, ID=2) the IDs immediately become:

1. A
2. C
3. D
4. E
5. F

Then rule 3 (currently D) is deleted, the IDs immediately become:

1. A
2. C
3. E
4. F

When the command finally deletes rule 4 it is deleting an unintended rule (F).

The code in Linux.pm is constructing the command with the IDs reverse sorted (good). However, it's using Perl's default lexical sort instead of numeric (bad). Because of this, rules are deleted in an order such as:
3
2
11
10
1

This causes various problems, including the possibility of locking the management node out.