Allow user to create an ACL Rule for Multiple Ports

[btzq]

ISSUE TYPE

• Improvement Request

COMPONENT NAME

Improvement Request (UI, Functionality)

CLOUDSTACK VERSION

4.19

CONFIGURATION

N/A

OS / ENVIRONMENT

N/A

SUMMARY

Note: This ticket is broken down as requested from the origianl post, #8841

Allow user to create an ACL Rule for Multiple Ports

• I remember reading somewhere that the logic is supported (Eg. Terraform Provider Docs)
• But the UI doesnt seem to support it.
• This will help greatly reduce the number of rules we create.

STEPS TO REPRODUCE

N/A

N/A

EXPECTED RESULTS

To be able to manage ACL Rules more easily for large scale projects

ACTUAL RESULTS

Challenging to use ACL rules for large scale projects.

[DaanHoogland]

@btzq the only way multiple ports are supported is through a range (start-port/end-port) I think you need to create multiple rules. You can implement a convenience API but it would split the request in multiple rules in the backend and would output it as such as well. If you want to implement logic to maintain a list of port(-ranges) this is going to be a big refactor job. iptables does support --match multiport --dports , so if we change our data model we can refactor the backend functionality as well.
How bad do you want it? ;)

[btzq]

@DaanHoogland , bad :P but maybe the implementation doesnt need to be sophisticated.

What i think can be done is that behind the scenes, it could be created as multiple rules. But in the frontend, the UI is diplayed to the user where with a Parent and Children display (similar to the VPC Network Section that displays all the VMs under the Network when it is being dropped down).

So rules with the same CIDR List, Action, Protocol etc can be displayed as a single list.

And only rules with different ports (and possibly other items) will be displayed as children rows of the dropdown.

Just my thoughts, am not a doctor.

[DaanHoogland]

So it more about displaying the state than about entering rules? It seems definitely a (second) valid use-case, but I'd put it low on my prio-list. again; How bad do you want it?

If both are needed/wanted, let's go for the datamodel change and implement the multiports in the VR.

[btzq]

Hmm. I think.. it would be wiser to have both.

I think its better to do it right the first time, and to have to redo/refactor it many times in the future.

And having this feature would definetly make Cloudstack more appealing to enterprises/large scale deployments.